Scripting in Splunk interface

[harshal_chakran]

Hi,
I wanted to know if complex scripting logic can be written on the splunk web interface. If yes, then how? or Do I have to use SDK's for writing complex logic.
As I understand till yet the things which we can do is create searches. Does splunk provide any functionality other than search to write complex business logic.

For e.g.
Suppose I have two different data sources. One is test data and other is reference data. Now on real-time, I have to track the errors on test data comparing it with reference data to get corresponding reason for the errors and their solution which is available in reference data by comparing the timestamp of both the data's.

In short, is it possible to run such highly complex business logics using search bar provided in splunk web interface or necessarily I have to use SDK.

[Ayn]

The available functionality from a 'search logic' perspective doesn't differ if you access Splunk through its API (for instance using an SDK) or through Splunkweb, or vice versa.

Splunk enables you to do all kinds of things through the functionality provided in its search language, your example included. It's hard to give you a complete solution without knowing the specifics of your scenario, but your problem definitely sounds like something that could be done in Splunk regardless of how you access it.