Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Modifying Field Values from search
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Modifying Field Values from search
I inserted a search command in a splunk search app as follows :
sourcetype="sexuality" | replace "Yan Yi" with jtyi in partner.
The partner field value did change but when i refresh and view the search results i saw that the new value did not replace the old value for the partner field.
How do i make sure that the field value is being replaced permanently each time i do this?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Once the raw data is indexed, there is no changing it. So any permanent modifications would have to happen at index time. This docs page has som information on changing the raw data at index-time: http://docs.splunk.com/Documentation/Splunk/latest/Data/Anonymizedatausingconfigurationfiles
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Various places in the Splunk installation directory. Go read docs. http://docs.splunk.com/Documentation/Splunk/latest/Admin/Aboutconfigurationfiles
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Where can i find the transforms.conf and props.conf file?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
No, there is not. The raw data is simply the incoming events, so the concept of changing it using a separate call doesn't exist. The only changes that can be made to the raw data is achieved by defining this in Splunk's configuration files, as is described in the link I posted.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Is there an REST API that specifically to changes the raw data at index-time? If there is , what the REST API endpoint for that?
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas
What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)
Automating Threat Operations and Threat Hunting with Recorded Future
