Splunk Enterprise

Adding attributes to existing event


Hi all,

Does anyone know of any way to update an event in Splunk?

so far what my searches brought me was reindexing the event, then deleting it with the delete command, and then reindex the whole bucket which frankly sucks....

I've noticed that Splunk Phantom supports event updating. Is it also possible in Splunk Enterprise?

Thank you very much, and may the helpers be blessed

Labels (1)
0 Karma


Events in Splunk are immutable.   They cannot be changed once indexed.  Even the delete command does not alter indexed data (it just hides it).

If this reply helps you, an upvote would be appreciated.
0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!