I would like to run a search of data in one index and update data in another index if the certain parameters are met.
Index1 holds semi-static data for user profiles. The index2 is holds streaming data coming in from the comments stream. What I would like to do is update the profile data interests field by adding football as an interest if the comment stream contains "football" .
Can I run a query against a username along these lines:
if index=index2 username= username AND comment.content="football" THEN index=index1 username= username ADD football to username.interest
I am sure there is a better way of doing this and really appreciate any help anyone could give.
take a look at the
collect command http://docs.splunk.com/Documentation/Splunk/6.1.4/SearchReference/Collect
This will put the search result into the specified index. So running somehting like this should do the job:
index=index2 username=username AND comment.content="football" | colect index=index1
Hope this helps ...