Splunk Search

How to create data according to search results?

Explorer

Hi all,

I"m kind of new to Splunk to maybe I am not using the right terms, but I need help with this scenario:

I have a stream of events indexed in my Splunk, where events can be "useradded" or "userremoved". I want to create a database with valid users, meaning that when I get "useradded" I will add the username to a new table, and when I get "userremoved" I will remove it from the table.

Thanks for your help

Tags (2)
0 Karma
1 Solution

Esteemed Legend

You need to create a KV Store Collection (your DB), then start a Real-Time search with script actions to call the REST Endpoints (described in link below) to add and remove individual records.

http://dev.splunk.com/view/SP-CAAAEZG

View solution in original post

Esteemed Legend

You need to create a KV Store Collection (your DB), then start a Real-Time search with script actions to call the REST Endpoints (described in link below) to add and remove individual records.

http://dev.splunk.com/view/SP-CAAAEZG

View solution in original post

Motivator

Can you please specify what you mean with "creating a database"? Do you want a Splunk report with all valid users, or do you really want to export the search results into a database?

0 Karma

Explorer

I want this list to be available for other searchs, so I think I need to export the results, and not only that, I want to remove existing data according to new results

0 Karma