Retrieve output data from Splunk

[JosIJntema]

Hi there,

We want to get data from Splunk after a Splunk search has outputted the data in a file.

Case
In Splunk we have events for each user. With these events we can categorise users in target groups. What we can do is make an output everyday where the users are updated and for each user id the target group is saved.

How could I then query this information from for example a website?

Is this a good use of Splunk? Is there another solution that better solves what I want to achieve?

Thanks!

[woodcock]

You are describing Summary Indexing; read all about it here:

https://docs.splunk.com/Documentation/Splunk/6.6.0/Knowledge/Usesummaryindexing

[gcusello]

Hi JosIJntema,
Yes, you can extract the number of events for each user, export results in a file and then categorize results in Excel.
to write the result of a Splunk search you can add at the end of your search the outputcsv command (see http://docs.splunk.com/Documentation/Splunk/6.6.0/SearchReference/Outputcsv).
Remember that the folder where you can find csv files is fixed: $SPLUNK_HOME/var/run/splunk/csv

But I'd prefer to do the same categorization adding to your app a lookup containing users and categories, in this way you can create a report with categories, users and the number of events for each user.
You have many advantages of this methis:

• you'll use only one tool to create your report;
• you don't need to do manual operations on results;
• in addition, you can also verify if someone of your users hasn't events.

Bye.
Giuseppe