Knowledge Management

Adding fields to already "summary-indexed" data

sranga
Path Finder

Hi

I have some summary-indexed data over the last couple of months. I was wondering if its possible to add another field to this data. Is it possible to modify the underlying query to add this new field and get past data "fixed"?

For example, if I have the following query:
index=blah type=a | sitimechart field1

Could I modify this to be:
index=blah type=a | sitimechart field1 by field2

Thanks for your help.

Ranga

Tags (1)
0 Karma
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

No it is not possible. Like all Splunk data, you basically can't modify it once it's been indexed.

You can however delete the old data and use the backfill script to re-generate the new data.

This is equivalent to what you're asking for anyway. There is no advantage to having the old summary data in your example. Your new summary would have to be regenerated from the original data, as it is impossible to construct (or "modify") "sitimechart field1 by field2" from "sitimechart field1" without simply regenerating from original.

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

No it is not possible. Like all Splunk data, you basically can't modify it once it's been indexed.

You can however delete the old data and use the backfill script to re-generate the new data.

This is equivalent to what you're asking for anyway. There is no advantage to having the old summary data in your example. Your new summary would have to be regenerated from the original data, as it is impossible to construct (or "modify") "sitimechart field1 by field2" from "sitimechart field1" without simply regenerating from original.

Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...