Splunk Search

Create new events from search results



How can I use a search result to create a new set of events (with a new sourcetype)? I'd like to schedule a report to perform analysis on some data and transform those results into an entirely new data set.

So far, I've only identified ways to append fields to an existing event. Is it possible to create entirely new events using the search language?

Thanks, Tim

Tags (1)


Only way which I have found so far is to use DB connect and create db output to database table as a middle man and then dbinput to take them back into splunk.
It is an ugly workaround, but it seems to be working.

0 Karma

Super Champion

You may want to take a look at lookups. This is a very helpful way to augment data to your events. See the following page from the docs:

If you want to add fields to a specific event, that's more difficult to accomplish, but it can be done using lookups. Take a look at this answer:

You would have to modify your application of this solution slightly, but the core idea is the same.


If you mean that you'd like to take some transformed results and re-index them as though they were events, you're looking for 'summary indexing'.


However Im not sure that it is what you're looking for. I think you might just be looking to learn more about the search language itself.

Lets say that <your search> matches a bunch of events, each event has a 'user' and a 'bytes' field, and you want to end up with rows that are individual users, you would just do something like:

<your search> | stats sum(bytes) by userid


<your search> | timechart sum(bytes) by userid

and I could go on describing common search language operators but we'd be here for hours. http://www.splunk.com/base/Documentation/latest/SearchReference/Stats

0 Karma
Get Updates on the Splunk Community!

Splunk Lantern | Spotlight on Security: Adoption Motions, War Stories, and More

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Cloud | Empowering Splunk Administrators with Admin Config Service (ACS)

Greetings, Splunk Cloud Admins and Splunk enthusiasts! The Admin Configuration Service (ACS) team is excited ...

Tech Talk | One Log to Rule Them All

One log to rule them all: how you can centralize your troubleshooting with Splunk logs We know how important ...