topic Re: Output of search as input to another index in Splunk Search

Output of search as input to another index

splunker_jim — Fri, 10 Feb 2012 19:33:14 GMT

Hi there,

I have an computationally expensive query which is (manually) run on the main index. Instead of running it every time I would like to send the output of this search to another index where the output can be seen and further analysis can be done.

Is it possible to take the output of a search on one index, and feed it as input to another index? Can such a search be scheduled?

Many thanks !

jim

Re: Output of search as input to another index

dmaislin_splunk — Fri, 10 Feb 2012 19:35:22 GMT

I think you can use the collect command to do just that.

Re: Output of search as input to another index

splunker_jim — Fri, 10 Feb 2012 20:53:25 GMT

Thanks for the quick response. I tried index=main | collect index=

I noticed some informational messages indicating that some temporary file(s) had been created.

However, if I do the following search
index=, I do not see any results.

It is as if the collect failed to add the search output into the other index.

I ensured that was already created before running any of the above commands. I used all default options when creating this index.

Re: Output of search as input to another index

dmaislin_splunk — Fri, 10 Feb 2012 21:00:13 GMT

When you ran the first collect command did it complete? When you run the new command, did you select all-time? I just tried it without issue. You can ignore the informational messages.

Re: Output of search as input to another index

splunker_jim — Mon, 28 Sep 2020 11:23:16 GMT

Thanks for your quick response dmaislin !

Here is what I did:

index=main source=blah | collect index=

I got the following messages in the message area (just below the search input area):

7,813 matching events
"Successfully wrote file to '1039324343_events.stash_new'."
"Changing file extension to .stash_new for file=$random$_events.stash"

Next, I did the following search

index= In the search result pane, I see the following message:

"No matching events found"

In all of the above cases, the time range was set to 'All time'.