Splunk Search

Dump search result into new index

smileyge
Path Finder

Is it possible to execute a query that merges several indexes and stores the result in another index which is then provided to end users for reporting? Reason to do so is to be able to accelerate the specific combinations of indexes and not need to do dynamic lookups on heavily used data sets that require a lookup otherwise.

1 Solution

martin_mueller
SplunkTrust
SplunkTrust

martin_mueller
SplunkTrust
SplunkTrust

Sure, you're probably looking for summary indexing: http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Usesummaryindexing

martin_mueller
SplunkTrust
SplunkTrust

Both the query writing to and the query reading from are regular Splunk searches... so anything you can do in a Splunk search, you can do in one of those.

0 Karma

smileyge
Path Finder

Can I take in lookup values or LDAPFILTER queries to supplement the eventData using a summary Index?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...