Getting Data In

Can I stream the splunk resultset back to splunk for indexing, without storing it in a file?

Contributor

I want to index the splunk resultset for future use. Do I always have to store it in a file?

Tags (1)
1 Solution

Builder

Use summary index. But it wont give u streaming, but without storing in file.

  1. Create search query & save it
  2. schedule it to run (goto settings -> Searches, reports, and alerts
  3. Edit the search
  4. Schedule it
  5. Enable summary index
  6. Select index name for storing the result set (you must create an index)

Since search is running on already indexed data, splunk license wont be used for re-indexing the result set on new index.

please let me know for any clarifications.

View solution in original post

Builder

Use summary index. But it wont give u streaming, but without storing in file.

  1. Create search query & save it
  2. schedule it to run (goto settings -> Searches, reports, and alerts
  3. Edit the search
  4. Schedule it
  5. Enable summary index
  6. Select index name for storing the result set (you must create an index)

Since search is running on already indexed data, splunk license wont be used for re-indexing the result set on new index.

please let me know for any clarifications.

View solution in original post

Contributor

thanks @jayannah 🙂

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!