Change a metadata value programaticaly

[michaelissartel]

Hi everyone,

Do you know a way to change the value of a metadata for a universal forwader ?

I add my own metadata with _meta = id::Mik.

Added in fields, I can see it in my events. Now I'de like to change the value Mik with another value.

Can I use python Api ? Splunk Cli ? Rest api ? It seem's to be a lot of solutions but for the moment I can't find one.

Thanks

[michaelissartel]

Ideally the value is updated by another program 😀

[michaelissartel]

https://community.splunk.com/t5/Splunk-Search/How-can-I-add-metadata-to-events-at-the-forwarder/m-p/...

For the metadata add

Thanks @rphillips_splk