Getting Data In

After identifying future timestamps in indexed events, is there any way to adjust time / date after fixing the issue?

dschmidt_cfi
Path Finder

Basically, my wineventlog is showing a 'latest event' of Dec 01, 2020 and I need to revert that back to the proper time/date. I believe, from the props file, it read in the hour as the year. That is not the issue, but rather one of 'Is it possible to un-index events?' Think I already know the answer, but thought I would ask.

0 Karma

grijhwani
Motivator

There are methods for removing indexed data from visibility, and then re-indexing. But that would eat into your daily consumption cap. There is no method that I know of for bulk manipulation of extant index data.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...