What I'm attempting to do is trawl through a bunch of calendar events, extract various fields and table those out looking for particular things that have or haven't been done, This is working (currently using data exported from calendars rather than getting ti with the api or the app) but I've come up against another issue. When I find an event where this particular action hasn't taken place then a report tells me of that. I then get that action done but am now wondering how can I update my data set with a field to flag that this task has been done. I'd like to write a new field that remaind within the data set after I've created it. Realis this isn't kinda how splunk works as the data has already been indexed when it got ingested by splunk but wondering if there's a way other that updating the original data then ingesting it again.
... View more