Splunk indexed data

[misteryuku]

Is Splunk's indexed data difficult or nearly impossible to modify?

[Ayn]

Yes. Once it's in the index, there are no mechanisms for changing it. You might be able to change data by editing the index file in a hex editor or something similar, but that'll raise other problems - it's certainly not something you should try at home.

[Ayn]

I suggest you visit the #splunk IRC channel. This is beginning to look like a chat session.

http://www.splunk.com/view/SP-CAAACDF

[misteryuku]

so the update occurs automatically?

[Damien_Dallimor]

United we stand.

No updates.

You can certainly insert new events and these might have common fields that change in state/value over time.If you think about it, conceptually this is what updating is.And then you can use Splunk searches to search on these fields with the added benefit of the change history of the fields over time to analyse.

01/04/2012 12:02:43 somefield=2 anotherfield=true
01/04/2012 12:03:32 somefield=6 anotherfield=true
01/04/2012 12:04:12 somefield=89 anotherfield=false

[gkanapathy]

I don't know why it's so hard to accept. It was never designed for modifications, and there are no API or internal ways to change data (other than delete entire indexes/files).

[Ayn]

Heh, well I take a strong stand because there's only one clear answer to your question.

Like I said in a comment in another question of yours, what is it you're trying to achieve? I get a feeling you're misunderstanding what a Splunk index is and how it can or can't be used.

[misteryuku]

Sorry about asking almost the same question again. Cos i find it hard to accept the truth. That's why i ask again so hopefully someone else gave me the similar answer as yours or you state your stand strongly.