Can we index data to Splunk which is from custom search command?

[loginsoftresear]

Hello all,
I have an add-on with written a custom search command and I wanted to know in How can I push the results of a custom search command into 'my_index', and how I can associate an index with a sourcetype?

Please, help me.

Thank You.

[DalJeanis]

There are several methods. If your records are already being assigned a specific sourcetype, then the standard one would be to key on the sourcetype to set the index. That would look something like this.

in props.conf

[some_sourcetype]
TRANSFORMS-index1 = set_index_1

In transforms.conf

 [set_index_1]
 REGEX    = . 
 DEST_KEY = _MetaData:Index 
 FORMAT   = some_index

[diogofgm · Accepted solution]

You can try to use the collect command at the end of your search to push the results into an index much like you would do with summary indexing.

From docs:
https://docs.splunk.com/Documentation/SplunkCloud/8.0.2001/SearchReference/Collect

What do you mean with "associate an index with a sourcetype"?
You can have multiple sourcetypes per index (e.g a lot of customers index a lot of data sources to index=main) and the same sourcetypes in multiple indexes (e.g some user might split data with the same sourcetpye per index based on data geo location).

[loginsoftresear]

It is pushing to summary index, can I push it normal index which I already have?