topic SPLUNK update existing events in Splunk Search

SPLUNK update existing events

imanpoeiri — Thu, 09 Jul 2015 11:07:12 GMT

Hi Experts,

I have a case like below:

I have events with order_id, order_status, ord_creation_date being indexed for almost 2 months before the user asked me to add more columns to be displayed; ord_completed_date, created_by.

So I add the extra columns easily but leaving the 2 months data without any value of the new columns. As I understand in any DB stacks we can do UPDATE statement to fill the new column with values, how can I do the same in SPLUNK?

Re: SPLUNK update existing events

alacercogitatus — Thu, 09 Jul 2015 11:46:48 GMT

Once data has been indexed (or consumed) by Splunk, you cannot change it. If you have the data, you could do an export all of the data, add the columns in vi/notepad/excel/whatever, and re-index the data. Splunk is a NOSQL "database", so there isn't any update you can perform on the already indexed data.

Re: SPLUNK update existing events

richgalloway — Thu, 09 Jul 2015 11:51:04 GMT

Splunk is not a database. You can't update events in Splunk. The only change you can make is to mark events for deletion.

However, if you still have the original data from the past 2 months, you can delete the existing events and re-index them to include the new fields.

Re: SPLUNK update existing events

imanpoeiri — Fri, 10 Jul 2015 03:06:54 GMT

Hi @alacercogitatus,

Now the other problem is, the estimated file size for the 2 months data is around 2GB. Would you have any suggestion what tools I can use to perform bulk updates?

Re: SPLUNK update existing events

vikashperiwal — Wed, 17 May 2017 07:04:22 GMT

I can get from your statement that onces data is indexed we cant update it. What if i can enter a new row with the updated data and then can display latest data in splunk form? just wanted to understand how can we do that dynamically from splunk form

Re: SPLUNK update existing events

vikashperiwal — Wed, 17 May 2017 07:05:02 GMT

and to add to prev comment i will need the historic data aswell ..so i cant delete the prev data