topic Re: Can I stream the splunk resultset back to splunk for indexing, without storing it in a file? in Getting Data In https://community.splunk.com/t5/Getting-Data-In/Can-I-stream-the-splunk-resultset-back-to-splunk-for-indexing/m-p/165966#M33671 <P>Use summary index. But it wont give u streaming, but without storing in file.</P> <OL> <LI>Create search query &amp; save it</LI> <LI>schedule it to run (goto settings -&gt; Searches, reports, and alerts</LI> <LI>Edit the search</LI> <LI>Schedule it</LI> <LI>Enable summary index</LI> <LI>Select index name for storing the result set (you must create an index)</LI> </OL> <P>Since search is running on already indexed data, splunk license wont be used for re-indexing the result set on new index.</P> <P>please let me know for any clarifications.</P> Tue, 30 Dec 2014 13:57:59 GMT jayannah 2014-12-30T13:57:59Z Can I stream the splunk resultset back to splunk for indexing, without storing it in a file? https://community.splunk.com/t5/Getting-Data-In/Can-I-stream-the-splunk-resultset-back-to-splunk-for-indexing/m-p/165965#M33670 <P>I want to index the splunk resultset for future use. Do I always have to store it in a file?</P> Tue, 30 Dec 2014 13:45:06 GMT https://community.splunk.com/t5/Getting-Data-In/Can-I-stream-the-splunk-resultset-back-to-splunk-for-indexing/m-p/165965#M33670 pramit46 2014-12-30T13:45:06Z Re: Can I stream the splunk resultset back to splunk for indexing, without storing it in a file? https://community.splunk.com/t5/Getting-Data-In/Can-I-stream-the-splunk-resultset-back-to-splunk-for-indexing/m-p/165966#M33671 <P>Use summary index. But it wont give u streaming, but without storing in file.</P> <OL> <LI>Create search query &amp; save it</LI> <LI>schedule it to run (goto settings -&gt; Searches, reports, and alerts</LI> <LI>Edit the search</LI> <LI>Schedule it</LI> <LI>Enable summary index</LI> <LI>Select index name for storing the result set (you must create an index)</LI> </OL> <P>Since search is running on already indexed data, splunk license wont be used for re-indexing the result set on new index.</P> <P>please let me know for any clarifications.</P> Tue, 30 Dec 2014 13:57:59 GMT https://community.splunk.com/t5/Getting-Data-In/Can-I-stream-the-splunk-resultset-back-to-splunk-for-indexing/m-p/165966#M33671 jayannah 2014-12-30T13:57:59Z Re: Can I stream the splunk resultset back to splunk for indexing, without storing it in a file? https://community.splunk.com/t5/Getting-Data-In/Can-I-stream-the-splunk-resultset-back-to-splunk-for-indexing/m-p/165967#M33672 <P>thanks @jayannah <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Wed, 07 Jan 2015 08:35:10 GMT https://community.splunk.com/t5/Getting-Data-In/Can-I-stream-the-splunk-resultset-back-to-splunk-for-indexing/m-p/165967#M33672 pramit46 2015-01-07T08:35:10Z