topic Re: can I insert data from the search field to test search expressions with in Splunk Search

can I insert data from the search field to test search expressions with

alexl1 — Mon, 19 May 2014 21:23:17 GMT

hello, I was wanting to do something like

insert "some test data key=value" | search ...

No data would actually be inserted, I would just use in order to test search commands.

Thanks,

lguinn2 — Tue, 20 May 2014 04:54:45 GMT

There is no command to insert data for testing. However, there are lots of ways to set up to test a search command:

Since search commands don't change any data, why not just search on the production system? Cut the time range back to "last 15 minutes" or "last 4 hours" to minimize the search time.
If you want to upload some test data, why not install a copy of free Splunk (or the trial license) on your laptop or desktop? Once you have a test instance set up, you can upload some real data and then use it to test your searches, etc. Or use some test data...
If you don't want to install a test server somewhere, you could create a test index and upload some data to it. Then just add index=test at the beginning of you search.

Would any of these options work?

curben — Sun, 21 Jan 2024 04:38:46 GMT

makeresults can be used to generate search results. An example from the documentation.

| makeresults
| eval test="buttercup rarity tenderhoof dash mcintosh fleetfoot mistmane"
| makemv delim=" " test 
| mvexpand test

Then you can use `search` or any other commands as usual.

| makeresults
| eval test="buttercup rarity tenderhoof dash mcintosh fleetfoot mistmane"
| makemv delim=" " test 
| mvexpand test
| search test="m*"