Splunk Search

Dump search result into new index

smileyge
Path Finder

Is it possible to execute a query that merges several indexes and stores the result in another index which is then provided to end users for reporting? Reason to do so is to be able to accelerate the specific combinations of indexes and not need to do dynamic lookups on heavily used data sets that require a lookup otherwise.

1 Solution

martin_mueller
SplunkTrust
SplunkTrust

martin_mueller
SplunkTrust
SplunkTrust

Sure, you're probably looking for summary indexing: http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Usesummaryindexing

martin_mueller
SplunkTrust
SplunkTrust

Both the query writing to and the query reading from are regular Splunk searches... so anything you can do in a Splunk search, you can do in one of those.

0 Karma

smileyge
Path Finder

Can I take in lookup values or LDAPFILTER queries to supplement the eventData using a summary Index?

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...