Getting Data In

after indexing data can we change the time stamp year in splunk ??? in same index

salmanbpc
New Member

Hello,...

i have loaded my data into splunk thats 2017 data i need to change the year of the data in index. because i have alraedy created some reports and dashboards with the variables.

is that possible to replace 2017 with 2019 in the same indexed data...????

0 Karma

jacobpevans
Motivator

Greetings @salmanbpc,

Even if possible, this is highly advised against. See @richgalloway's answer here: https://answers.splunk.com/answers/412085/is-it-possible-to-modify-an-indexed-event.html.

Long story short, you need to delete the index (or clear it of the relevant data), modify the source (log or otherwise), clear the fishbucket, and reindex the data with the proper timestamps. Be very careful doing each of those things if you're in a production environment.

Cheers,
Jacob

If you feel this response answered your question, please do not forget to mark it as such. If it did not, but you do have the answer, feel free to answer your own post and accept that as the answer.
Get Updates on the Splunk Community!

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...