Can I stream the splunk resultset back to splunk for indexing, without storing it in a file?

[pramit46]

I want to index the splunk resultset for future use. Do I always have to store it in a file?

[jayannah · Accepted solution]

Use summary index. But it wont give u streaming, but without storing in file.

1. Create search query & save it
2. schedule it to run (goto settings -> Searches, reports, and alerts
3. Edit the search
4. Schedule it
5. Enable summary index
6. Select index name for storing the result set (you must create an index)

Since search is running on already indexed data, splunk license wont be used for re-indexing the result set on new index.

please let me know for any clarifications.

[pramit46]

thanks @jayannah 🙂