Getting Data In

Editing an indexed log

Engager

We made a mistake and logged a few 1000 fields in an event with a wrong format. Is there any way that we could edit these logs and change the already indexed events?

0 Karma

SplunkTrust
SplunkTrust

Indexed events cannot be changed, modified, or edited. The best you can do is delete them and re-index them with the correct format.

---
If this reply helps you, an upvote would be appreciated.
0 Karma