Getting Data In

Is it possible to modify a log that has already been indexed?

jrodriguezap
Contributor

Hi?
Is it possible to modify a record that has already been indexed?
Or failing that, delete it and write another with the same _Time

Tags (3)
0 Karma

Damien_Dallimor
Ultra Champion

You can not update already indexed data.

You can soft delete a specific event with the delete search command

More info here

Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...