https://community.splunk.com/t5/Splunk-Search/How-to-force-a-scripted-input-to-be-run-at-search-time-in-order/m-p/226889#M66981 <P>I'm writing a health check dashboard and I want to invoke one of my normal input scripts, on demand, at the time the search is run and use the data collected in the dashboard chart. It seems that inputs are totally divorced from the input/ingestion processes so I can schedule the input any time I want, but I can't force the input to occur at search time - Is this correct? </P> Wed, 11 Jan 2017 16:30:10 GMT drodman29 2017-01-11T16:30:10Z https://community.splunk.com/t5/Splunk-Search/How-to-force-a-scripted-input-to-be-run-at-search-time-in-order/m-p/226889#M66981 <P>I'm writing a health check dashboard and I want to invoke one of my normal input scripts, on demand, at the time the search is run and use the data collected in the dashboard chart. It seems that inputs are totally divorced from the input/ingestion processes so I can schedule the input any time I want, but I can't force the input to occur at search time - Is this correct? </P> Wed, 11 Jan 2017 16:30:10 GMT https://community.splunk.com/t5/Splunk-Search/How-to-force-a-scripted-input-to-be-run-at-search-time-in-order/m-p/226889#M66981 drodman29 2017-01-11T16:30:10Z https://community.splunk.com/t5/Splunk-Search/How-to-force-a-scripted-input-to-be-run-at-search-time-in-order/m-p/226890#M66982 <P>You may be looking at custom search commands. You can create a generating command to retrieve data from remote system and use it in SPL. See more information here:</P> <P><A href="http://dev.splunk.com/view/python-sdk/SP-CAAAEU2">http://dev.splunk.com/view/python-sdk/SP-CAAAEU2</A><BR /> <A href="https://docs.splunk.com/Documentation/Splunk/6.5.1/Search/Aboutcustomsearchcommands">https://docs.splunk.com/Documentation/Splunk/6.5.1/Search/Aboutcustomsearchcommands</A></P> Wed, 11 Jan 2017 16:41:45 GMT https://community.splunk.com/t5/Splunk-Search/How-to-force-a-scripted-input-to-be-run-at-search-time-in-order/m-p/226890#M66982 somesoni2 2017-01-11T16:41:45Z https://community.splunk.com/t5/Splunk-Search/How-to-force-a-scripted-input-to-be-run-at-search-time-in-order/m-p/226891#M66983 <P>Hi drodman29, </P> <P>The short answer is NO - data must be collected and indexed first before they can be searched, not the other way around. Performing a search to trigger data input would be like putting cart before a horse. </P> <P>The Splunk data pipeline is explained here in detail: <A href="http://docs.splunk.com/Documentation/Splunk/6.5.1/Deploy/Datapipeline">http://docs.splunk.com/Documentation/Splunk/6.5.1/Deploy/Datapipeline</A></P> <P>Hope this helps. Thanks! <BR /> Hunter</P> Wed, 11 Jan 2017 16:52:00 GMT https://community.splunk.com/t5/Splunk-Search/How-to-force-a-scripted-input-to-be-run-at-search-time-in-order/m-p/226891#M66983 hunters_splunk 2017-01-11T16:52:00Z https://community.splunk.com/t5/Splunk-Search/How-to-force-a-scripted-input-to-be-run-at-search-time-in-order/m-p/226892#M66984 <P>I'm looking into lookups as a way to invoke a script at search time, either way as a custom search command or a lookup it looks like py is the answer. </P> Wed, 11 Jan 2017 18:10:21 GMT https://community.splunk.com/t5/Splunk-Search/How-to-force-a-scripted-input-to-be-run-at-search-time-in-order/m-p/226892#M66984 drodman29 2017-01-11T18:10:21Z