Splunk Search

Modifying Field Values from search

misteryuku
Communicator

I inserted a search command in a splunk search app as follows :
sourcetype="sexuality" | replace "Yan Yi" with jtyi in partner.

The partner field value did change but when i refresh and view the search results i saw that the new value did not replace the old value for the partner field.

How do i make sure that the field value is being replaced permanently each time i do this?

Tags (3)
0 Karma

Ayn
Legend

Once the raw data is indexed, there is no changing it. So any permanent modifications would have to happen at index time. This docs page has som information on changing the raw data at index-time: http://docs.splunk.com/Documentation/Splunk/latest/Data/Anonymizedatausingconfigurationfiles

Ayn
Legend

Various places in the Splunk installation directory. Go read docs. http://docs.splunk.com/Documentation/Splunk/latest/Admin/Aboutconfigurationfiles

misteryuku
Communicator

Where can i find the transforms.conf and props.conf file?

0 Karma

Ayn
Legend

No, there is not. The raw data is simply the incoming events, so the concept of changing it using a separate call doesn't exist. The only changes that can be made to the raw data is achieved by defining this in Splunk's configuration files, as is described in the link I posted.

misteryuku
Communicator

Is there an REST API that specifically to changes the raw data at index-time? If there is , what the REST API endpoint for that?

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...