after indexing data can we change the time stamp year in splunk ??? in same index

[salmanbpc]

Hello,...

i have loaded my data into splunk thats 2017 data i need to change the year of the data in index. because i have alraedy created some reports and dashboards with the variables.

is that possible to replace 2017 with 2019 in the same indexed data...????

[jacobevans]

Greetings @salmanbpc,

Even if possible, this is highly advised against. See @richgalloway's answer here: https://answers.splunk.com/answers/412085/is-it-possible-to-modify-an-indexed-event.html.

Long story short, you need to delete the index (or clear it of the relevant data), modify the source (log or otherwise), clear the fishbucket, and reindex the data with the proper timestamps. Be very careful doing each of those things if you're in a production environment.