How to force a scripted input to be run at search time, in order to use remote data?

[drodman29]

I'm writing a health check dashboard and I want to invoke one of my normal input scripts, on demand, at the time the search is run and use the data collected in the dashboard chart. It seems that inputs are totally divorced from the input/ingestion processes so I can schedule the input any time I want, but I can't force the input to occur at search time - Is this correct?

[hunters_splunk]

Hi drodman29,

The short answer is NO - data must be collected and indexed first before they can be searched, not the other way around. Performing a search to trigger data input would be like putting cart before a horse.

The Splunk data pipeline is explained here in detail: http://docs.splunk.com/Documentation/Splunk/6.5.1/Deploy/Datapipeline

Hope this helps. Thanks!
Hunter

[somesoni2 · Accepted solution]

You may be looking at custom search commands. You can create a generating command to retrieve data from remote system and use it in SPL. See more information here:

http://dev.splunk.com/view/python-sdk/SP-CAAAEU2
https://docs.splunk.com/Documentation/Splunk/6.5.1/Search/Aboutcustomsearchcommands

[drodman29]

I'm looking into lookups as a way to invoke a script at search time, either way as a custom search command or a lookup it looks like py is the answer.