https://community.splunk.com/t5/Splunk-Search/How-to-stream-real-time-search-results-into-a-summary-index-or/m-p/134811#M36825 <P>Hi<BR /> I tried it. But failed. Im using splunk 6.1.9.<BR /> Is Splunk version wrong?</P> Wed, 06 Jan 2016 09:38:52 GMT joy76 2016-01-06T09:38:52Z https://community.splunk.com/t5/Splunk-Search/How-to-stream-real-time-search-results-into-a-summary-index-or/m-p/134806#M36820 <P>I had some pre-processing requirement using splunk real-time search, so once I put together those results, I would like to stream the results of the real-time search in another index. I couldn't figure out a way to do it, so I ended up writing a python script that kicks off a real-time search and pipes the results as scripted input. </P> <P>There's gotta be a better way of doing this! Anybody had similar demands?</P> Tue, 14 Apr 2015 15:26:09 GMT https://community.splunk.com/t5/Splunk-Search/How-to-stream-real-time-search-results-into-a-summary-index-or/m-p/134806#M36820 clyde772 2015-04-14T15:26:09Z https://community.splunk.com/t5/Splunk-Search/How-to-stream-real-time-search-results-into-a-summary-index-or/m-p/134807#M36821 <P>Try the <STRONG>collect</STRONG> command. something like this:</P> <PRE><CODE> ............ | collect index=newindex </CODE></PRE> <P>For more informations, take a look here: <A href="http://docs.splunk.com/Documentation/Splunk/6.2.2/SearchReference/Collect">http://docs.splunk.com/Documentation/Splunk/6.2.2/SearchReference/Collect</A></P> Tue, 14 Apr 2015 16:01:35 GMT https://community.splunk.com/t5/Splunk-Search/How-to-stream-real-time-search-results-into-a-summary-index-or/m-p/134807#M36821 stephanefotso 2015-04-14T16:01:35Z https://community.splunk.com/t5/Splunk-Search/How-to-stream-real-time-search-results-into-a-summary-index-or/m-p/134808#M36822 <P>Stephanefotso, thanks for the reply! Of course I have tried that, but with real-time search, it wound not write the results until I stop the search. I am trying to make it to just stream into an index, as a real-time search crunches out the rows. Let me know if you have any other thoughts. </P> <P>Appreciate it!</P> Tue, 14 Apr 2015 16:05:37 GMT https://community.splunk.com/t5/Splunk-Search/How-to-stream-real-time-search-results-into-a-summary-index-or/m-p/134808#M36822 clyde772 2015-04-14T16:05:37Z https://community.splunk.com/t5/Splunk-Search/How-to-stream-real-time-search-results-into-a-summary-index-or/m-p/134809#M36823 <P>Surprising! OK annother way to do it is to create an alert, wich, wen triggered, populate a summary index you have created. You can set a condition for the alert to be triggered as <STRONG>when the number of events is greatter than 0</STRONG>, or setup a <STRONG>Real Time</STRONG> alert. i did it and it is working perfectly!<BR /> Let me know your impression!</P> Thu, 16 Apr 2015 08:36:35 GMT https://community.splunk.com/t5/Splunk-Search/How-to-stream-real-time-search-results-into-a-summary-index-or/m-p/134809#M36823 stephanefotso 2015-04-16T08:36:35Z https://community.splunk.com/t5/Splunk-Search/How-to-stream-real-time-search-results-into-a-summary-index-or/m-p/134810#M36824 <P>Stephanefotso, That's a great idea. It's great, how we can tweak Splunk to do anything huh? Thanks! Let me give it a shot!</P> Fri, 17 Apr 2015 00:53:59 GMT https://community.splunk.com/t5/Splunk-Search/How-to-stream-real-time-search-results-into-a-summary-index-or/m-p/134810#M36824 clyde772 2015-04-17T00:53:59Z https://community.splunk.com/t5/Splunk-Search/How-to-stream-real-time-search-results-into-a-summary-index-or/m-p/134811#M36825 <P>Hi<BR /> I tried it. But failed. Im using splunk 6.1.9.<BR /> Is Splunk version wrong?</P> Wed, 06 Jan 2016 09:38:52 GMT https://community.splunk.com/t5/Splunk-Search/How-to-stream-real-time-search-results-into-a-summary-index-or/m-p/134811#M36825 joy76 2016-01-06T09:38:52Z