Splunk Search

SPLUNK update existing events

imanpoeiri
Communicator

Hi Experts,

I have a case like below:

I have events with order_id, order_status, ord_creation_date being indexed for almost 2 months before the user asked me to add more columns to be displayed; ord_completed_date, created_by.

So I add the extra columns easily but leaving the 2 months data without any value of the new columns. As I understand in any DB stacks we can do UPDATE statement to fill the new column with values, how can I do the same in SPLUNK?

Tags (3)

richgalloway
SplunkTrust
SplunkTrust

Splunk is not a database. You can't update events in Splunk. The only change you can make is to mark events for deletion.

However, if you still have the original data from the past 2 months, you can delete the existing events and re-index them to include the new fields.

---
If this reply helps you, Karma would be appreciated.

vikashperiwal
Path Finder

I can get from your statement that onces data is indexed we cant update it. What if i can enter a new row with the updated data and then can display latest data in splunk form? just wanted to understand how can we do that dynamically from splunk form

0 Karma

vikashperiwal
Path Finder

and to add to prev comment i will need the historic data aswell ..so i cant delete the prev data

0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

Once data has been indexed (or consumed) by Splunk, you cannot change it. If you have the data, you could do an export all of the data, add the columns in vi/notepad/excel/whatever, and re-index the data. Splunk is a NOSQL "database", so there isn't any update you can perform on the already indexed data.

imanpoeiri
Communicator

Hi @alacercogitatus,

Now the other problem is, the estimated file size for the 2 months data is around 2GB. Would you have any suggestion what tools I can use to perform bulk updates?

0 Karma
Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...