Splunk Search
Highlighted

How to force a scripted input to be run at search time, in order to use remote data?

Path Finder

I'm writing a health check dashboard and I want to invoke one of my normal input scripts, on demand, at the time the search is run and use the data collected in the dashboard chart. It seems that inputs are totally divorced from the input/ingestion processes so I can schedule the input any time I want, but I can't force the input to occur at search time - Is this correct?

0 Karma
Highlighted

Re: How to force a scripted input to be run at search time, in order to use remote data?

SplunkTrust
SplunkTrust

You may be looking at custom search commands. You can create a generating command to retrieve data from remote system and use it in SPL. See more information here:

http://dev.splunk.com/view/python-sdk/SP-CAAAEU2
https://docs.splunk.com/Documentation/Splunk/6.5.1/Search/Aboutcustomsearchcommands

View solution in original post

0 Karma
Highlighted

Re: How to force a scripted input to be run at search time, in order to use remote data?

Path Finder

I'm looking into lookups as a way to invoke a script at search time, either way as a custom search command or a lookup it looks like py is the answer.

0 Karma
Highlighted

Re: How to force a scripted input to be run at search time, in order to use remote data?

Splunk Employee
Splunk Employee

Hi drodman29,

The short answer is NO - data must be collected and indexed first before they can be searched, not the other way around. Performing a search to trigger data input would be like putting cart before a horse.

The Splunk data pipeline is explained here in detail: http://docs.splunk.com/Documentation/Splunk/6.5.1/Deploy/Datapipeline

Hope this helps. Thanks!
Hunter

0 Karma