Change a metadata value programaticaly - Splunk Community

Splunk Search

Hi everyone,

Do you know a way to change the value of a metadata for a universal forwader ?

I add my own metadata with _meta = id::Mik.

Added in fields, I can see it in my events. Now I'de like to change the value Mik with another value.

Can I use python Api ? Splunk Cli ? Rest api ? It seem's to be a lot of solutions but for the moment I can't find one.

Thanks

Ideally the value is updated by another program 😀

https://community.splunk.com/t5/Splunk-Search/How-can-I-add-metadata-to-events-at-the-forwarder/m-p/...

For the metadata add

Thanks @rphillips_splk

Get Updates on the Splunk Community!

Deep Dive: Optimizing Telemetry Pipelines in Splunk Observability Cloud

In this session, we will peel back the layers of Splunk Observability Cloud’s cost-optimization features. ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Data Drivers: How We're Streaming Real-Time F1 Telemetry Directly into Splunk ...

Data Drivers: Every Lap Tells a Story The Spectacle Two F1 racing sims go head-to-head on the .conf26 show ...