Create a new sourcetype on the fly

[asarolkar]

I have a subsearch like this:

sourcetype="syslog" SERIAL=* | eval SERIAL_NUM=SERIAL | lookup FileLookup SERIAL_NUM

I want to take this and turn it into a new sourcetype.

Any ideas how to go about it ?

[Ayn]

sourcetype for a log event is set at index-time, and as such you cannot change it afterwards.

[Ayn]

Not CREATE it on the fly, but you can certainly write the results of a search to another index. Check out the docs on summary indexing: http://docs.splunk.com/Documentation/Splunk/4.3.1/Knowledge/Usesummaryindexing

You'll likely want to make use of the collect command: http://docs.splunk.com/Documentation/Splunk/latest/searchreference/collect

[asarolkar]

can I create a new index then which has the results of this search ?