Knowledge Management

Is it possible to have action.summary_index._name have multiple values?

haleyykidd
Engager

Is it possible to have action.summary_index._name have multiple values? Ie. can I have a saved search write to more than one summary index?

Ex. action.summary_index._name = my_alerts,general_summary

Labels (1)
0 Karma
1 Solution

yeahnah
Motivator

Hi @haleyykidd 

I'd have to ask why would you want to duplicate data into two indexes?

I doubt this can be done via Splunk configuration, but no harm in trying (if you have not already)...

https://docs.splunk.com/Documentation/Splunk/latest/Admin/Savedsearchesconf

yeahnah_0-1681937881671.png

A possible way is to use the collect command in your saved search instead.

https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Collect?ref=hk

For example...

 

... your search ...
| collect index=summary1
| collect index=summary2

 

Hope this helps

View solution in original post

0 Karma

yeahnah
Motivator

Hi @haleyykidd 

I'd have to ask why would you want to duplicate data into two indexes?

I doubt this can be done via Splunk configuration, but no harm in trying (if you have not already)...

https://docs.splunk.com/Documentation/Splunk/latest/Admin/Savedsearchesconf

yeahnah_0-1681937881671.png

A possible way is to use the collect command in your saved search instead.

https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Collect?ref=hk

For example...

 

... your search ...
| collect index=summary1
| collect index=summary2

 

Hope this helps

0 Karma

haleyykidd
Engager

Basically, we have two summary indices that we use for two different functions but for which the data the saved search is writing is relevant (to both).

We did try setting two indices as the target, and it was accepted syntactically but in practice did not work - the results ended up writing to neither index. So if anyone is running into this, know that if you set both indices you will effectively get the results written to neither index without any failures being thrown.

We are looking into the collect option now, but as backup would just have two separate saved searches.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In November, the Splunk Threat Research Team had one release of new security content via the Enterprise ...

Index This | Divide 100 by half. What do you get?

November 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

❄️ Celebrate the season with our December lineup of Community Office Hours, Tech Talks, and Webinars! ...