Forms in Splunk

[urvishah]

Hi, From what I read so far, Splunk forms can be used to fetch/filter data based on User's requirement. The data in the case is already present in Splunk. However, I wish to insert data into specific Index in Splunk. Can this also be done using Splunk Forms? 

[isoutamo]

Hi

basically yes as @livehybrid already said. There are also other ways to store end user's answers into splunk, but what is best is depending on your use case. Those are e.g. kvstore, csv file, db connect etc.

If you need more specific answer, then you should told your use case and what you looking for.

r. Ismo

[livehybrid · Accepted solution]

Hi @urvishah 

Are you wanting to allow users to write data to a Splunk index without being logged in to Splunk itself? If so you would need an external site/system which then sends the collected form data to a HEC receiver to be indexed in Splunk.

If you want something within Splunk itself then you can use a Dashboard with multiple text inputs/dropdowns etc. You can then use the tokens from these inputs to build a search with a "collect" statement that would populate your index.

|makeresults 
| eval name=$name|s$
| eval formField1=$formField1|s$
| collect index=yourIndex

Please let me know how you get on and consider adding karma to this or any other answer if it has helped.
Regards

Will