How do I update field values in Splunk?

[Roy_9]

Hello,

Is it possible to create a form where users can update field values in Splunk?Does eval or replace conditions help?

can someone help me with the process?

Thanks

[gcusello]

Hi @Roy_9,

Splunk data aren't modifiable, this is one of the building point of Splunk solution!

In other words: Splunk isn't a DB.

if you want to have a modifiable table, you have to create a lookup with the results of a search and then modify the records you want and display the modified table.

Ciao.

Giuseppe