Hello,
Is it possible to create a form where users can update field values in Splunk?Does eval or replace conditions help?
can someone help me with the process?
Thanks
Hi @Roy_9,
Splunk data aren't modifiable, this is one of the building point of Splunk solution!
In other words: Splunk isn't a DB.
if you want to have a modifiable table, you have to create a lookup with the results of a search and then modify the records you want and display the modified table.
Ciao.
Giuseppe