Getting Data In

Can we index data to Splunk which is from custom search command?

loginsoftresear
Explorer

Hello all,
I have an add-on with written a custom search command and I wanted to know in How can I push the results of a custom search command into 'my_index', and how I can associate an index with a sourcetype?

Please, help me.

Thank You.

Labels (2)
0 Karma
1 Solution

diogofgm
SplunkTrust
SplunkTrust

You can try to use the collect command at the end of your search to push the results into an index much like you would do with summary indexing.

From docs:
https://docs.splunk.com/Documentation/SplunkCloud/8.0.2001/SearchReference/Collect

What do you mean with "associate an index with a sourcetype"?
You can have multiple sourcetypes per index (e.g a lot of customers index a lot of data sources to index=main) and the same sourcetypes in multiple indexes (e.g some user might split data with the same sourcetpye per index based on data geo location).

------------
Hope I was able to help you. If so, some karma would be appreciated.

View solution in original post

DalJeanis
Legend

There are several methods. If your records are already being assigned a specific sourcetype, then the standard one would be to key on the sourcetype to set the index. That would look something like this.

in props.conf

[some_sourcetype]
TRANSFORMS-index1 = set_index_1

In transforms.conf

 [set_index_1]
 REGEX    = . 
 DEST_KEY = _MetaData:Index 
 FORMAT   = some_index
0 Karma

diogofgm
SplunkTrust
SplunkTrust

You can try to use the collect command at the end of your search to push the results into an index much like you would do with summary indexing.

From docs:
https://docs.splunk.com/Documentation/SplunkCloud/8.0.2001/SearchReference/Collect

What do you mean with "associate an index with a sourcetype"?
You can have multiple sourcetypes per index (e.g a lot of customers index a lot of data sources to index=main) and the same sourcetypes in multiple indexes (e.g some user might split data with the same sourcetpye per index based on data geo location).

------------
Hope I was able to help you. If so, some karma would be appreciated.

loginsoftresear
Explorer

It is pushing to summary index, can I push it normal index which I already have?

0 Karma
Get Updates on the Splunk Community!

Thanks for the Memories! Splunk University, .conf24, and Community Connections

Thank you to everyone in the Splunk Community who joined us for .conf24 – starting with Splunk University and ...

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...