I'm currently working on a Splunk search that will show me DHCP leases for specific hosts and how long a host had a specific IP address. I'd like to record the time stamp for the beginning of a lease to a host when 'DHCPACK' is seen, and then go back to that same row in the table and add the lease end time when 'DHCPRELEASE' or 'DHCPEXPIRE' is seen. Is it possible to go back and add to a previous row in a table in Splunk, or is this out of Splunk's capabilities?
It's a matter of switching the way you think about it. Splunk's search language can do a lot, the tough part is finding the right commands to transform your data in a way you want to see it.
It's a little hard to give exact searches without knowing what your data looks like, but as a simple example, you could narrow your search to only show the ack release expire data. Then sort the results by host and time to see the timestamps of when each occurred. So assuming that you have the type of event in maybe an action field then something like
[your base search] (action="dhcpack" OR action="dhcprelease" OR action="dhcpexpire") | sort host ip _time | table host ip _time action
And if that looks correct/helpful, you might be able to use autoregress and/or delta to get the time difference between those events. Or you might be able to use eval and/or some multi-value commands/functions to combine/break events up until you see what you've transformed the result set into exactly what you're looking for.
So the answer is yes, it probably can be done. But it's going to be a little more involved than just going back and adding a timestamp unfortunately. If you share some of the actual data, we might be able to help you come up with the search you're looking for.