Splunk Search

Dump search result into new index

Path Finder

Is it possible to execute a query that merges several indexes and stores the result in another index which is then provided to end users for reporting? Reason to do so is to be able to accelerate the specific combinations of indexes and not need to do dynamic lookups on heavily used data sets that require a lookup otherwise.

1 Solution

SplunkTrust
SplunkTrust

SplunkTrust
SplunkTrust

SplunkTrust
SplunkTrust

Both the query writing to and the query reading from are regular Splunk searches... so anything you can do in a Splunk search, you can do in one of those.

0 Karma

Path Finder

Can I take in lookup values or LDAPFILTER queries to supplement the eventData using a summary Index?

0 Karma