https://community.splunk.com/t5/Getting-Data-In/Editing-an-indexed-log/m-p/284334#M54334 <P>We made a mistake and logged a few 1000 fields in an event with a wrong format. Is there any way that we could edit these logs and change the already indexed events?</P> Wed, 27 Jul 2016 06:37:19 GMT anoopsankar 2016-07-27T06:37:19Z https://community.splunk.com/t5/Getting-Data-In/Editing-an-indexed-log/m-p/284334#M54334 <P>We made a mistake and logged a few 1000 fields in an event with a wrong format. Is there any way that we could edit these logs and change the already indexed events?</P> Wed, 27 Jul 2016 06:37:19 GMT https://community.splunk.com/t5/Getting-Data-In/Editing-an-indexed-log/m-p/284334#M54334 anoopsankar 2016-07-27T06:37:19Z https://community.splunk.com/t5/Getting-Data-In/Editing-an-indexed-log/m-p/284335#M54335 <P>Indexed events cannot be changed, modified, or edited. The best you can do is delete them and re-index them with the correct format.</P> Wed, 27 Jul 2016 12:25:48 GMT https://community.splunk.com/t5/Getting-Data-In/Editing-an-indexed-log/m-p/284335#M54335 richgalloway 2016-07-27T12:25:48Z