topic Re: Create a new sourcetype on the fly in Getting Data In https://community.splunk.com/t5/Getting-Data-In/Create-a-new-sourcetype-on-the-fly/m-p/30128#M5241 <P>can I create a new index then which has the results of this search ?</P> Thu, 19 Apr 2012 16:28:11 GMT asarolkar 2012-04-19T16:28:11Z Create a new sourcetype on the fly https://community.splunk.com/t5/Getting-Data-In/Create-a-new-sourcetype-on-the-fly/m-p/30126#M5239 <P>I have a <EM>subsearch</EM> like this:</P> <BLOCKQUOTE> <P>sourcetype="syslog" SERIAL=* | eval SERIAL_NUM=SERIAL | lookup FileLookup SERIAL_NUM </P> </BLOCKQUOTE> <P>I want to take this and turn it into a new sourcetype.</P> <P>Any ideas how to go about it ?</P> Mon, 28 Sep 2020 11:41:45 GMT https://community.splunk.com/t5/Getting-Data-In/Create-a-new-sourcetype-on-the-fly/m-p/30126#M5239 asarolkar 2020-09-28T11:41:45Z Re: Create a new sourcetype on the fly https://community.splunk.com/t5/Getting-Data-In/Create-a-new-sourcetype-on-the-fly/m-p/30127#M5240 <P>sourcetype for a log event is set at index-time, and as such you cannot change it afterwards.</P> Thu, 19 Apr 2012 07:37:59 GMT https://community.splunk.com/t5/Getting-Data-In/Create-a-new-sourcetype-on-the-fly/m-p/30127#M5240 Ayn 2012-04-19T07:37:59Z Re: Create a new sourcetype on the fly https://community.splunk.com/t5/Getting-Data-In/Create-a-new-sourcetype-on-the-fly/m-p/30128#M5241 <P>can I create a new index then which has the results of this search ?</P> Thu, 19 Apr 2012 16:28:11 GMT https://community.splunk.com/t5/Getting-Data-In/Create-a-new-sourcetype-on-the-fly/m-p/30128#M5241 asarolkar 2012-04-19T16:28:11Z Re: Create a new sourcetype on the fly https://community.splunk.com/t5/Getting-Data-In/Create-a-new-sourcetype-on-the-fly/m-p/30129#M5242 <P>Not CREATE it on the fly, but you can certainly write the results of a search to another index. Check out the docs on summary indexing: <A href="http://docs.splunk.com/Documentation/Splunk/4.3.1/Knowledge/Usesummaryindexing">http://docs.splunk.com/Documentation/Splunk/4.3.1/Knowledge/Usesummaryindexing</A></P> <P>You'll likely want to make use of the collect command: <A href="http://docs.splunk.com/Documentation/Splunk/latest/searchreference/collect">http://docs.splunk.com/Documentation/Splunk/latest/searchreference/collect</A></P> Sat, 21 Apr 2012 07:09:14 GMT https://community.splunk.com/t5/Getting-Data-In/Create-a-new-sourcetype-on-the-fly/m-p/30129#M5242 Ayn 2012-04-21T07:09:14Z