topic Re: Splunk indexed data in Getting Data In

Splunk indexed data

misteryuku — Tue, 13 Mar 2012 06:33:43 GMT

Is Splunk's indexed data difficult or nearly impossible to modify?

Re: Splunk indexed data

Ayn — Tue, 13 Mar 2012 06:44:11 GMT

Yes. Once it's in the index, there are no mechanisms for changing it. You might be able to change data by editing the index file in a hex editor or something similar, but that'll raise other problems - it's certainly not something you should try at home.

Re: Splunk indexed data

misteryuku — Tue, 13 Mar 2012 06:54:09 GMT

Sorry about asking almost the same question again. Cos i find it hard to accept the truth. That's why i ask again so hopefully someone else gave me the similar answer as yours or you state your stand strongly.

Re: Splunk indexed data

Ayn — Tue, 13 Mar 2012 06:56:22 GMT

Heh, well I take a strong stand because there's only one clear answer to your question.

Like I said in a comment in another question of yours, what is it you're trying to achieve? I get a feeling you're misunderstanding what a Splunk index is and how it can or can't be used.

Re: Splunk indexed data

gkanapathy — Tue, 13 Mar 2012 07:50:16 GMT

I don't know why it's so hard to accept. It was never designed for modifications, and there are no API or internal ways to change data (other than delete entire indexes/files).

Re: Splunk indexed data

Damien_Dallimor — Tue, 13 Mar 2012 08:05:27 GMT

United we stand.

No updates.

You can certainly insert new events and these might have common fields that change in state/value over time.If you think about it, conceptually this is what updating is.And then you can use Splunk searches to search on these fields with the added benefit of the change history of the fields over time to analyse.

01/04/2012 12:02:43 somefield=2 anotherfield=true
01/04/2012 12:03:32 somefield=6 anotherfield=true
01/04/2012 12:04:12 somefield=89 anotherfield=false

Re: Splunk indexed data

misteryuku — Tue, 13 Mar 2012 08:10:37 GMT

so the update occurs automatically?

Re: Splunk indexed data

Ayn — Tue, 13 Mar 2012 08:11:45 GMT

I suggest you visit the #splunk IRC channel. This is beginning to look like a chat session.

http://www.splunk.com/view/SP-CAAACDF