Splunk Search

How to stream real-time search results into a summary index or another index?

clyde772
Communicator

I had some pre-processing requirement using splunk real-time search, so once I put together those results, I would like to stream the results of the real-time search in another index. I couldn't figure out a way to do it, so I ended up writing a python script that kicks off a real-time search and pipes the results as scripted input.

There's gotta be a better way of doing this! Anybody had similar demands?

0 Karma
1 Solution

stephanefotso
Motivator

Try the collect command. something like this:

   ............ | collect index=newindex

For more informations, take a look here: http://docs.splunk.com/Documentation/Splunk/6.2.2/SearchReference/Collect

SGF

View solution in original post

0 Karma

stephanefotso
Motivator

Try the collect command. something like this:

   ............ | collect index=newindex

For more informations, take a look here: http://docs.splunk.com/Documentation/Splunk/6.2.2/SearchReference/Collect

SGF
0 Karma

clyde772
Communicator

Stephanefotso, thanks for the reply! Of course I have tried that, but with real-time search, it wound not write the results until I stop the search. I am trying to make it to just stream into an index, as a real-time search crunches out the rows. Let me know if you have any other thoughts.

Appreciate it!

0 Karma

stephanefotso
Motivator

Surprising! OK annother way to do it is to create an alert, wich, wen triggered, populate a summary index you have created. You can set a condition for the alert to be triggered as when the number of events is greatter than 0, or setup a Real Time alert. i did it and it is working perfectly!
Let me know your impression!

SGF

clyde772
Communicator

Stephanefotso, That's a great idea. It's great, how we can tweak Splunk to do anything huh? Thanks! Let me give it a shot!

0 Karma

joy76
Path Finder

Hi
I tried it. But failed. Im using splunk 6.1.9.
Is Splunk version wrong?

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...