Splunk REST API

[misteryuku]

Does Splunk REST API allow us to update search results when search results are retrieved and then return the updated result back to splunk? If that's the case, what is the API for that?

[Damien_Dallimor]

You are searching on data that has already been indexed in Splunk.

The concept of an "update" doesn't really apply as it might in the database world with SQL.

There is a Splunk "delete" search command that will "soft" delete events from the search results.

And you can certainly "insert" new events via the REST API using the Receivers endpoints, and then subsequent searches can operate on this newly inserted data. Easiest to do this using an SDK from dev.splunk.com

[misteryuku]

Can i access the data directly from the splunk server and update the data directly using the rest api without searching? Or it is impossible like what you mentioned ?

[misteryuku]

Indexed data is diffult to modify is it?