Splunk Enterprise

How to modify an Event in a particular index?

kanishka97167
Observer

I am trying to add data into Splunk in Json format. All the events have the same format. Lets say we have some format like this:

[

     field1 : value1

     field2 : value2

]

 

Is is possible for me to update value1 to some value3, given field1? I am looking to first achieve this from website and if this possible, I am looking for REST APIs to achieve the same. 

Labels (1)
Tags (2)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

You must do this before events have indexed. After those are written to disk you cannot change those.

If you want to change those values before indexing that maybe do by props and transforms. But maybe it's easier to do it totally outside of Splunk?

Can you open with more details what is your issue which you are trying to solve?

0 Karma

kanishka97167
Observer

Hi isoutamo,

 

Thanks a lot for the quick response. I am basically trying to add data real time into Splunk for visualization using some dashboards. I am concerned with 3 operations here: Add, Delete and Modify. Adding and Deleting records works fine. But I am unable to find any resources to modify any existing events.

 

Also Could you please help me find some resources where I can add or delete events using the REST APIs that Splunk provides? I am specifically looking for these:

1. Add an event into a particular index

2. Given an index and field name(specific field name in the Json formatted event), delete that event from the index.

0 Karma
Get Updates on the Splunk Community!

Buttercup Games: Further Dashboarding Techniques

Hello! We are excited to kick off a new series of blogs from SplunkTrust member ITWhisperer, who demonstrates ...

Message Parsing in SOCK

Introduction This blog post is part of an ongoing series on SOCK enablement. In this blog post, I will write ...

Exploring the OpenTelemetry Collector’s Kubernetes annotation-based discovery

We’ve already explored a few topics around observability in a Kubernetes environment -- Common Failures in a ...