Splunk Search

How can I update the metadata ?

New Member

Hello,
I deleted the redundant logs from an index with "delete" command. Now, I would like to update the metadata info. Is it possible?

Tags (1)
0 Karma
1 Solution

Revered Legend

From the link , the delete command doesn't update the metadata. There is no direct method to update the metadata. The workaround will be do a re-indexing of the data which in most cases is not feasible.

http://answers.splunk.com/answers/2031/remove-hostname-from-the-metadata.html

View solution in original post

Revered Legend

From the link , the delete command doesn't update the metadata. There is no direct method to update the metadata. The workaround will be do a re-indexing of the data which in most cases is not feasible.

http://answers.splunk.com/answers/2031/remove-hostname-from-the-metadata.html

View solution in original post

SplunkTrust
SplunkTrust

Just let the "wrong" buckets age out, it'll fix itself over the retention period for that index.

Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!