Adding attributes to existing event

[johnsynack]

Hi all,

Does anyone know of any way to update an event in Splunk?

so far what my searches brought me was reindexing the event, then deleting it with the delete command, and then reindex the whole bucket which frankly sucks....

I've noticed that Splunk Phantom supports event updating. Is it also possible in Splunk Enterprise?

Thank you very much, and may the helpers be blessed

[richgalloway]

Events in Splunk are immutable.   They cannot be changed once indexed.  Even the delete command does not alter indexed data (it just hides it).