topic Can we index data to Splunk which is from custom search command? in Getting Data In

Can we index data to Splunk which is from custom search command?

loginsoftresear — Mon, 08 Jun 2020 19:38:59 GMT

Hello all,
I have an add-on with written a custom search command and I wanted to know in How can I push the results of a custom search command into 'my_index', and how I can associate an index with a sourcetype?

Please, help me.

Thank You.

Re: Can we index data to Splunk which is from custom search command?

diogofgm — Fri, 10 Apr 2020 19:04:06 GMT

You can try to use the collect command at the end of your search to push the results into an index much like you would do with summary indexing.

From docs:
https://docs.splunk.com/Documentation/SplunkCloud/8.0.2001/SearchReference/Collect

What do you mean with "associate an index with a sourcetype"?
You can have multiple sourcetypes per index (e.g a lot of customers index a lot of data sources to index=main) and the same sourcetypes in multiple indexes (e.g some user might split data with the same sourcetpye per index based on data geo location).

Re: Can we index data to Splunk which is from custom search command?

DalJeanis — Fri, 10 Apr 2020 19:17:47 GMT

There are several methods. If your records are already being assigned a specific sourcetype, then the standard one would be to key on the sourcetype to set the index. That would look something like this.

in props.conf

[some_sourcetype]
TRANSFORMS-index1 = set_index_1

In transforms.conf

 [set_index_1]
 REGEX    = . 
 DEST_KEY = _MetaData:Index 
 FORMAT   = some_index

Re: Can we index data to Splunk which is from custom search command?

loginsoftresear — Mon, 13 Apr 2020 05:15:38 GMT

It is pushing to summary index, can I push it normal index which I already have?