Any point in updating Sampledata.zip?

[RVDowning]

Is there any point in periodically updating Sampledata.zip, and if so how does one best go about it?

[ChrisG · Accepted solution]

The file is used for the Splunk Tutorial, which assumes you are going to step through the whole procedure on the same day (otherwise the time ranges in the search instructions will be off). The file contains data timestamped for the past seven days, and is updated daily. If you are going to return to the tutorial at a later time, you should download and import the file again using the instructions in the Tutorial.

[RVDowning]

Yeah, that is what I was trying to avoid, but didn't know how to go about it.

[ChrisG]

Depends on how you set the time range of your search, but if you searched for all time, yes, you would have two identical events at different times.

[RVDowning]

So, if one searches the data then transactions would appear twice, once with a newer timestamp and once with an older timestamp?

[ChrisG]

You don't need to remove the older data, because the timestamps will be...older!

[RVDowning]

Ok thanks. So one just re-imports the data? I didn't know whether the older data needed to be removed first or there was some other procedure to overlay the data.