Getting Data In

Editing an indexed log

anoopsankar
Engager

We made a mistake and logged a few 1000 fields in an event with a wrong format. Is there any way that we could edit these logs and change the already indexed events?

richgalloway
SplunkTrust
SplunkTrust

Indexed events cannot be changed, modified, or edited. The best you can do is delete them and re-index them with the correct format.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...

Splunk MCP & Agentic AI: Machine Data Without Limits

Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization uses ...