can we execute a script or savedsearch as soon as source has some event to the indexer

[khreddy]

I have a requirement to process and correlate the data as soon as things come in.

The data has some triggering events, which can be identified and used.

Is that possible in splunk to run something based on the incoming data.

[khreddy]

I mean to run the search or script as soon as the data enters into the splunk indexer ... like applying transforms or sed on incoming data .... similarly can we trigger a script and do get additional info and index them into splunk while indexing ........not running on the splunk UI as realtime job.

[richgalloway]

There's no such thing as index-time search or script execution.  You can use transforms or Ingest Actions to act on the data before it is indexed, but there are limits to what can be done.  If you use Splunk Cloud then Edge Processor may be a solution.  There also are third-party products that may be able to help.

Depending on how that data is ingested, you may be able to use a scripted or modular input instead.  That script can do anything you like to the data before it's indexed.

Keep in mind that the more you try to do to the data in the indexer the slower indexing will be.

[richgalloway]

Saved searches can run as a real-time search, which means they will process events as soon as they arrive.  There is no equivalent for scripts.

That said, real-time searches should be avoided.  Every real-time search is pinned to a CPU so no other searches will use the CPU (that applies to the SH and *all* indexers).

Chances are a requirement for "real-time" processing doesn't mean "0 seconds delay".  A search that runs once each minute often can satisfy most requirements.