Splunk Search

SPLUNK update existing events

imanpoeiri
Communicator

Hi Experts,

I have a case like below:

I have events with order_id, order_status, ord_creation_date being indexed for almost 2 months before the user asked me to add more columns to be displayed; ord_completed_date, created_by.

So I add the extra columns easily but leaving the 2 months data without any value of the new columns. As I understand in any DB stacks we can do UPDATE statement to fill the new column with values, how can I do the same in SPLUNK?

Tags (3)

richgalloway
SplunkTrust
SplunkTrust

Splunk is not a database. You can't update events in Splunk. The only change you can make is to mark events for deletion.

However, if you still have the original data from the past 2 months, you can delete the existing events and re-index them to include the new fields.

---
If this reply helps you, Karma would be appreciated.

vikashperiwal
Path Finder

I can get from your statement that onces data is indexed we cant update it. What if i can enter a new row with the updated data and then can display latest data in splunk form? just wanted to understand how can we do that dynamically from splunk form

0 Karma

vikashperiwal
Path Finder

and to add to prev comment i will need the historic data aswell ..so i cant delete the prev data

0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

Once data has been indexed (or consumed) by Splunk, you cannot change it. If you have the data, you could do an export all of the data, add the columns in vi/notepad/excel/whatever, and re-index the data. Splunk is a NOSQL "database", so there isn't any update you can perform on the already indexed data.

imanpoeiri
Communicator

Hi @alacercogitatus,

Now the other problem is, the estimated file size for the 2 months data is around 2GB. Would you have any suggestion what tools I can use to perform bulk updates?

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...