Splunk Search

Is it possible to modify medata?

New Member

I would like to know if I can use Splunk to access and modify metadata. And if the answer is yes, which plugin or addon should I use?
Thank you for answering.

0 Karma

Super Champion

can you please let me know which metadata you mean? Did you mean indextime fields "host", "source" etc?
(or search time tstats based data)

0 Karma


What metadata do you want to change? The metadata/local.meta files can be modified however you like. Metadata about indexed data cannot be changed, however.

If this reply helps you, an upvote would be appreciated.
0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!