Getting Data In

Splunk indexed data

misteryuku
Communicator

Is Splunk's indexed data difficult or nearly impossible to modify?

Tags (1)
0 Karma

Ayn
Legend

Yes. Once it's in the index, there are no mechanisms for changing it. You might be able to change data by editing the index file in a hex editor or something similar, but that'll raise other problems - it's certainly not something you should try at home.

Ayn
Legend

I suggest you visit the #splunk IRC channel. This is beginning to look like a chat session.

http://www.splunk.com/view/SP-CAAACDF

0 Karma

misteryuku
Communicator

so the update occurs automatically?

0 Karma

Damien_Dallimor
Ultra Champion

United we stand.

No updates.

You can certainly insert new events and these might have common fields that change in state/value over time.If you think about it, conceptually this is what updating is.And then you can use Splunk searches to search on these fields with the added benefit of the change history of the fields over time to analyse.

01/04/2012 12:02:43 somefield=2 anotherfield=true
01/04/2012 12:03:32 somefield=6 anotherfield=true
01/04/2012 12:04:12 somefield=89 anotherfield=false

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

I don't know why it's so hard to accept. It was never designed for modifications, and there are no API or internal ways to change data (other than delete entire indexes/files).

0 Karma

Ayn
Legend

Heh, well I take a strong stand because there's only one clear answer to your question.

Like I said in a comment in another question of yours, what is it you're trying to achieve? I get a feeling you're misunderstanding what a Splunk index is and how it can or can't be used.

0 Karma

misteryuku
Communicator

Sorry about asking almost the same question again. Cos i find it hard to accept the truth. That's why i ask again so hopefully someone else gave me the similar answer as yours or you state your stand strongly.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...