How to run a search of data in one index and update data in another index if the certain parameters are met

[BrandSentiment]

I would like to run a search of data in one index and update data in another index if the certain parameters are met.

Index1 holds semi-static data for user profiles. The index2 is holds streaming data coming in from the comments stream. What I would like to do is update the profile data interests field by adding football as an interest if the comment stream contains "football" .

Can I run a query against a username along these lines:

if index=index2 username= username AND comment.content="football" THEN index=index1 username= username ADD football to username.interest

I am sure there is a better way of doing this and really appreciate any help anyone could give.

Thank you

[MuS]

Hi BrandSentiment,

take a look at the collect command http://docs.splunk.com/Documentation/Splunk/6.1.4/SearchReference/Collect
This will put the search result into the specified index. So running somehting like this should do the job:

index=index2 username=username AND comment.content="football" | colect index=index1

Hope this helps ...

cheers, MuS