Splunk Search

How can I update the metadata ?

cogrunc
New Member

Hello,
I deleted the redundant logs from an index with "delete" command. Now, I would like to update the metadata info. Is it possible?

Tags (1)
0 Karma
1 Solution

somesoni2
Revered Legend

From the link , the delete command doesn't update the metadata. There is no direct method to update the metadata. The workaround will be do a re-indexing of the data which in most cases is not feasible.

http://answers.splunk.com/answers/2031/remove-hostname-from-the-metadata.html

View solution in original post

somesoni2
Revered Legend

From the link , the delete command doesn't update the metadata. There is no direct method to update the metadata. The workaround will be do a re-indexing of the data which in most cases is not feasible.

http://answers.splunk.com/answers/2031/remove-hostname-from-the-metadata.html

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

Just let the "wrong" buckets age out, it'll fix itself over the retention period for that index.

Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.