How do I update field values in Splunk?

Roy_9 — Thu, 22 Sep 2022 02:21:20 GMT

Hello,

Is it possible to create a form where users can update field values in Splunk?Does eval or replace conditions help?

can someone help me with the process?

Thanks

Re: How do I update field values in Splunk?

gcusello — Thu, 22 Sep 2022 06:35:45 GMT

Hi @Roy_9,

Splunk data aren't modifiable, this is one of the building point of Splunk solution!

In other words: Splunk isn't a DB.

if you want to have a modifiable table, you have to create a lookup with the results of a search and then modify the records you want and display the modified table.

Ciao.

Giuseppe

topic Re: How do I update field values in Splunk? in Dashboards & Visualizations

How do I update field values in Splunk?

Re: How do I update field values in Splunk?