topic Re: Create new events from search results in Splunk Search

Create new events from search results

Tim — Tue, 05 Oct 2010 06:21:48 GMT

Hi,

How can I use a search result to create a new set of events (with a new sourcetype)? I'd like to schedule a report to perform analysis on some data and transform those results into an entirely new data set.

So far, I've only identified ways to append fields to an existing event. Is it possible to create entirely new events using the search language?

Thanks, Tim

Re: Create new events from search results

sideview — Tue, 05 Oct 2010 07:47:42 GMT

If you mean that you'd like to take some transformed results and re-index them as though they were events, you're looking for 'summary indexing'.

http://www.splunk.com/base/Documentation/latest/Knowledge/Usesummaryindexing?r=searchtip

However Im not sure that it is what you're looking for. I think you might just be looking to learn more about the search language itself.

Lets say that <your search> matches a bunch of events, each event has a 'user' and a 'bytes' field, and you want to end up with rows that are individual users, you would just do something like:

<your search> | stats sum(bytes) by userid

<your search> | timechart sum(bytes) by userid

and I could go on describing common search language operators but we'd be here for hours. http://www.splunk.com/base/Documentation/latest/SearchReference/Stats

Re: Create new events from search results

Lowell — Tue, 05 Oct 2010 20:08:12 GMT

You may want to take a look at lookups. This is a very helpful way to augment data to your events. See the following page from the docs:

Use field lookups to add information to your events

If you want to add fields to a specific event, that's more difficult to accomplish, but it can be done using lookups. Take a look at this answer:

Correlate (and tag!) Splunk events with Change Control Tickets

You would have to modify your application of this solution slightly, but the core idea is the same.

Re: Create new events from search results

jkomarek — Fri, 31 May 2019 08:35:49 GMT

Only way which I have found so far is to use DB connect and create db output to database table as a middle man and then dbinput to take them back into splunk.
It is an ugly workaround, but it seems to be working.