Splunk Search

SPLUNK update existing events

imanpoeiri
Communicator

Hi Experts,

I have a case like below:

I have events with order_id, order_status, ord_creation_date being indexed for almost 2 months before the user asked me to add more columns to be displayed; ord_completed_date, created_by.

So I add the extra columns easily but leaving the 2 months data without any value of the new columns. As I understand in any DB stacks we can do UPDATE statement to fill the new column with values, how can I do the same in SPLUNK?

Tags (3)

richgalloway
SplunkTrust
SplunkTrust

Splunk is not a database. You can't update events in Splunk. The only change you can make is to mark events for deletion.

However, if you still have the original data from the past 2 months, you can delete the existing events and re-index them to include the new fields.

---
If this reply helps you, Karma would be appreciated.

vikashperiwal
Path Finder

I can get from your statement that onces data is indexed we cant update it. What if i can enter a new row with the updated data and then can display latest data in splunk form? just wanted to understand how can we do that dynamically from splunk form

0 Karma

vikashperiwal
Path Finder

and to add to prev comment i will need the historic data aswell ..so i cant delete the prev data

0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

Once data has been indexed (or consumed) by Splunk, you cannot change it. If you have the data, you could do an export all of the data, add the columns in vi/notepad/excel/whatever, and re-index the data. Splunk is a NOSQL "database", so there isn't any update you can perform on the already indexed data.

imanpoeiri
Communicator

Hi @alacercogitatus,

Now the other problem is, the estimated file size for the 2 months data is around 2GB. Would you have any suggestion what tools I can use to perform bulk updates?

0 Karma
Get Updates on the Splunk Community!

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...

Platform Highlights | January 2023 Newsletter

 January 2023Peace on Earth and Peace of Mind With Business ResilienceAll organizations can start the new year ...