SPLUNK update existing events

[imanpoeiri]

Hi Experts,

I have a case like below:

I have events with order_id, order_status, ord_creation_date being indexed for almost 2 months before the user asked me to add more columns to be displayed; ord_completed_date, created_by.

So I add the extra columns easily but leaving the 2 months data without any value of the new columns. As I understand in any DB stacks we can do UPDATE statement to fill the new column with values, how can I do the same in SPLUNK?

[richgalloway]

Splunk is not a database. You can't update events in Splunk. The only change you can make is to mark events for deletion.

However, if you still have the original data from the past 2 months, you can delete the existing events and re-index them to include the new fields.

[vikashperiwal]

I can get from your statement that onces data is indexed we cant update it. What if i can enter a new row with the updated data and then can display latest data in splunk form? just wanted to understand how can we do that dynamically from splunk form

[vikashperiwal]

and to add to prev comment i will need the historic data aswell ..so i cant delete the prev data

[alacercogitatus]

Once data has been indexed (or consumed) by Splunk, you cannot change it. If you have the data, you could do an export all of the data, add the columns in vi/notepad/excel/whatever, and re-index the data. Splunk is a NOSQL "database", so there isn't any update you can perform on the already indexed data.

[imanpoeiri]

Hi @alacercogitatus,

Now the other problem is, the estimated file size for the 2 months data is around 2GB. Would you have any suggestion what tools I can use to perform bulk updates?