Getting Data In
Highlighted

Can we index data to Splunk which is from custom search command?

Hello all,
I have an add-on with written a custom search command and I wanted to know in How can I push the results of a custom search command into 'my_index', and how I can associate an index with a sourcetype?

Please, help me.

Thank You.

Labels (2)
0 Karma
Highlighted

Re: Can we index data to Splunk which is from custom search command?

Motivator

You can try to use the collect command at the end of your search to push the results into an index much like you would do with summary indexing.

From docs:
https://docs.splunk.com/Documentation/SplunkCloud/8.0.2001/SearchReference/Collect

What do you mean with "associate an index with a sourcetype"?
You can have multiple sourcetypes per index (e.g a lot of customers index a lot of data sources to index=main) and the same sourcetypes in multiple indexes (e.g some user might split data with the same sourcetpye per index based on data geo location).

------------
Hope I was able to help you. If so, an upvote would be appreciated.

View solution in original post

Highlighted

Re: Can we index data to Splunk which is from custom search command?

It is pushing to summary index, can I push it normal index which I already have?

0 Karma
Highlighted

Re: Can we index data to Splunk which is from custom search command?

SplunkTrust
SplunkTrust

There are several methods. If your records are already being assigned a specific sourcetype, then the standard one would be to key on the sourcetype to set the index. That would look something like this.

in props.conf

[some_sourcetype]
TRANSFORMS-index1 = set_index_1

In transforms.conf

 [set_index_1]
 REGEX    = . 
 DEST_KEY = _MetaData:Index 
 FORMAT   = some_index
0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.