- Splunk Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Re: Can I modify Data from Splunk using Splunk API...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Can I modify Data from Splunk using Splunk API?
Lets say if i do not search for the data using the splunk search then can i edit the data directly from the splunk server using the Splunk's REST api?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Edit as in change data that is already in Splunk's index? No. Once data is indexed, there is no (easy) way of altering it.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Nothing i just want to know if there is such thing as updating the indexed data since i don't see any documentation on that on this Splunk website.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Could you tell us a bit more about what you're trying to achieve?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
When you search in Splunk - regardless of which method you're using - you're getting your results from Splunk's index, yes.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Normally when log file data is sent to splunk, splunk indexes the file data right? When you search for the result using Splunk's REST API, the result normally returns indexed data right? Am i right in both statements i made?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
OK. In that case the answer is no.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes. That is what mean. Edit as in change data that is already in Splunk's index.
Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!
They're back! Join the SplunkTrust and MVP at .conf24
Enterprise Security Content Update (ESCU) | New Releases
