Splunk Search

Overwriting existing timestamp in summary index?

yuwtennis
Communicator

Hi!

Is it possible to overwrite the summary index with same timestamp?

Lets say you already have a summary index as following.

_time fieldA fieldB
2014/1/1 00:00 a b
2014/1/2 00:00 a b
2014/1/3 00:00 a b

I want to rewrite the first record to recalculate the value as c
_time fieldA fieldB
2014/1/1 00:00 a c
2014/1/2 00:00 a b
2014/1/3 00:00 a b

Do you have to use the delete and then repopulate it?

Thanks,
Yu

Tags (2)
0 Karma

Ayn
Legend

Yes, you will have to repopulate it - you cannot change any data in an index once it's been written.

yuwtennis
Communicator

Hello ayn.

Thank you for the comment.
Is there be a way to detect the duplicates and delete the old ones?

Thanks,
Yu

0 Karma
Get Updates on the Splunk Community!

Join Us for Splunk University and Get Your Bootcamp Game On!

If you know, you know! Splunk University is the vibe this summer so register today for bootcamps galore ...

.conf24 | Learning Tracks for Security, Observability, Platform, and Developers!

.conf24 is taking place at The Venetian in Las Vegas from June 11 - 14. Continue reading to learn about the ...

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...