Getting Data In

How-To Change Indexed Data?


v4.3.1 on sles 11.1

i have some data that was incorrectly indexed, the host name assignment got messed up. is there a way via Splunk gui to change the host name field of the indexed data, if so how? or do i need to use sed via cli?

as example, some data belonging to host=myHost got indexed as host=Mon and now i wish to modify these indexed events so that host=Mon is replaced with host=myHost

Tags (3)

Splunk Employee
Splunk Employee

You can do event level meta data changes at index time via transforms.conf


i fixed my indexing issue. i now have metadata tagged as host=Mon when it should be host=myHost, etc.

0 Karma

Ultra Champion

Exactly, there are 6 things that must be correct at index time, since you more or less can't change them afterwards. They are;


Get them wrong, then Drainys answer is the easiest way to go.



i cant re-index the data, i'll get same results, reason being is that the raw data format has changed and is defined as sourcetype=syslog, hence it will incorrectly tag some data as host=myHost and some of it as host=Mon. i need a way to edit the metadata, etc. i could re-index if i modified syslog source type, but i would rather not do that, etc.

0 Karma


Alas, once you've indexed metadata like that the best option is to clear the index, clear the fishbucket on any remote forwarder and reindex the data.

Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

New Learning Videos on Topics Most Requested by You! Plus This Month’s New Splunk ...

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

How I Instrumented a Rust Application Without Knowing Rust

As a technical writer, I often have to edit or create code snippets for Splunk's distributions of ...