Getting Data In

Retrieve output data from Splunk

JosIJntema
Explorer

Hi there,

We want to get data from Splunk after a Splunk search has outputted the data in a file.

Case
In Splunk we have events for each user. With these events we can categorise users in target groups. What we can do is make an output everyday where the users are updated and for each user id the target group is saved.

How could I then query this information from for example a website?

Is this a good use of Splunk? Is there another solution that better solves what I want to achieve?

Thanks!

Tags (1)
0 Karma

woodcock
Esteemed Legend

You are describing Summary Indexing; read all about it here:

https://docs.splunk.com/Documentation/Splunk/6.6.0/Knowledge/Usesummaryindexing

0 Karma

gcusello
Legend

Hi JosIJntema,
Yes, you can extract the number of events for each user, export results in a file and then categorize results in Excel.
to write the result of a Splunk search you can add at the end of your search the outputcsv command (see http://docs.splunk.com/Documentation/Splunk/6.6.0/SearchReference/Outputcsv).
Remember that the folder where you can find csv files is fixed: $SPLUNK_HOME/var/run/splunk/csv

But I'd prefer to do the same categorization adding to your app a lookup containing users and categories, in this way you can create a report with categories, users and the number of events for each user.
You have many advantages of this methis:

  • you'll use only one tool to create your report;
  • you don't need to do manual operations on results;
  • in addition, you can also verify if someone of your users hasn't events.

Bye.
Giuseppe

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>