I have a subsearch like this:
sourcetype="syslog" SERIAL=* | eval SERIAL_NUM=SERIAL | lookup FileLookup SERIAL_NUM
I want to take this and turn it into a new sourcetype.
Any ideas how to go about it ?
sourcetype for a log event is set at index-time, and as such you cannot change it afterwards.
Not CREATE it on the fly, but you can certainly write the results of a search to another index. Check out the docs on summary indexing: http://docs.splunk.com/Documentation/Splunk/4.3.1/Knowledge/Usesummaryindexing
You'll likely want to make use of the collect command: http://docs.splunk.com/Documentation/Splunk/latest/searchreference/collect
can I create a new index then which has the results of this search ?
