Splunk Enterprise

Adding attributes to existing event

johnsynack
Loves-to-Learn

Hi all,

Does anyone know of any way to update an event in Splunk?

so far what my searches brought me was reindexing the event, then deleting it with the delete command, and then reindex the whole bucket which frankly sucks....

I've noticed that Splunk Phantom supports event updating. Is it also possible in Splunk Enterprise?

Thank you very much, and may the helpers be blessed

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Events in Splunk are immutable.   They cannot be changed once indexed.  Even the delete command does not alter indexed data (it just hides it).

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...