https://community.splunk.com/t5/Getting-Data-In/Editing-an-existing-data-input-creates-new-item/m-p/122779#M25397 <P>Sorry, I obviously misunderstood what you meant. I don't have a good answer for the issue you're having, sorry.</P> Fri, 01 Nov 2013 08:09:28 GMT Ayn 2013-11-01T08:09:28Z https://community.splunk.com/t5/Getting-Data-In/Editing-an-existing-data-input-creates-new-item/m-p/122775#M25393 <P>When I try to edit an existing data input, it's creating a new one. Shouldn't it just update it?</P> Wed, 30 Oct 2013 17:36:58 GMT https://community.splunk.com/t5/Getting-Data-In/Editing-an-existing-data-input-creates-new-item/m-p/122775#M25393 adrianp 2013-10-30T17:36:58Z https://community.splunk.com/t5/Getting-Data-In/Editing-an-existing-data-input-creates-new-item/m-p/122776#M25394 <P>No, Splunk is a time-series database - it will read events and assign a timestamp to them once. Events that are indexed will not be modified - if you make changes to existing data that Splunk has already indexed, Splunk will interpret that as that the whole file has changed and its contents needs to be reindexed.</P> Wed, 30 Oct 2013 19:38:16 GMT https://community.splunk.com/t5/Getting-Data-In/Editing-an-existing-data-input-creates-new-item/m-p/122776#M25394 Ayn 2013-10-30T19:38:16Z https://community.splunk.com/t5/Getting-Data-In/Editing-an-existing-data-input-creates-new-item/m-p/122777#M25395 <P>Um, I don't follow. I'm talking about where you edit Data Inputs and select, File, Events Log, syslog, etc... When I click on one that I created (to edit it because I made a mistake), after I hit save, instead of updating the one I was editing, it just creates a new item.</P> Thu, 31 Oct 2013 01:47:50 GMT https://community.splunk.com/t5/Getting-Data-In/Editing-an-existing-data-input-creates-new-item/m-p/122777#M25395 adrianp 2013-10-31T01:47:50Z https://community.splunk.com/t5/Getting-Data-In/Editing-an-existing-data-input-creates-new-item/m-p/122778#M25396 <P><A href="http://MYSERVER:8000/en-US/manager/launcher/data/inputs/udp">http://MYSERVER:8000/en-US/manager/launcher/data/inputs/udp</A></P> Thu, 31 Oct 2013 01:48:57 GMT https://community.splunk.com/t5/Getting-Data-In/Editing-an-existing-data-input-creates-new-item/m-p/122778#M25396 adrianp 2013-10-31T01:48:57Z https://community.splunk.com/t5/Getting-Data-In/Editing-an-existing-data-input-creates-new-item/m-p/122779#M25397 <P>Sorry, I obviously misunderstood what you meant. I don't have a good answer for the issue you're having, sorry.</P> Fri, 01 Nov 2013 08:09:28 GMT https://community.splunk.com/t5/Getting-Data-In/Editing-an-existing-data-input-creates-new-item/m-p/122779#M25397 Ayn 2013-11-01T08:09:28Z