Dump search result into new index

[smileyge]

Is it possible to execute a query that merges several indexes and stores the result in another index which is then provided to end users for reporting? Reason to do so is to be able to accelerate the specific combinations of indexes and not need to do dynamic lookups on heavily used data sets that require a lookup otherwise.

[martin_mueller · Accepted solution]

Sure, you're probably looking for summary indexing: http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Usesummaryindexing

[martin_mueller]

Both the query writing to and the query reading from are regular Splunk searches... so anything you can do in a Splunk search, you can do in one of those.

[smileyge]

Can I take in lookup values or LDAPFILTER queries to supplement the eventData using a summary Index?