v4.3.1 on sles 11.1
i have some data that was incorrectly indexed, the host name assignment got messed up. is there a way via Splunk gui to change the host name field of the indexed data, if so how? or do i need to use sed via cli?
as example, some data belonging to host=myHost got indexed as host=Mon and now i wish to modify these indexed events so that host=Mon is replaced with host=myHost
Exactly, there are 6 things that must be correct at index time, since you more or less can't change them afterwards. They are;
index host source sourcetype timestamps linebreaking
Get them wrong, then Drainys answer is the easiest way to go.
i cant re-index the data, i'll get same results, reason being is that the raw data format has changed and is defined as sourcetype=syslog, hence it will incorrectly tag some data as host=myHost and some of it as host=Mon. i need a way to edit the metadata, etc. i could re-index if i modified syslog source type, but i would rather not do that, etc.