Splunk Search

How to stream real-time search results into a summary index or another index?

clyde772
Communicator

I had some pre-processing requirement using splunk real-time search, so once I put together those results, I would like to stream the results of the real-time search in another index. I couldn't figure out a way to do it, so I ended up writing a python script that kicks off a real-time search and pipes the results as scripted input.

There's gotta be a better way of doing this! Anybody had similar demands?

0 Karma
1 Solution

stephanefotso
Motivator

Try the collect command. something like this:

   ............ | collect index=newindex

For more informations, take a look here: http://docs.splunk.com/Documentation/Splunk/6.2.2/SearchReference/Collect

SGF

View solution in original post

0 Karma

stephanefotso
Motivator

Try the collect command. something like this:

   ............ | collect index=newindex

For more informations, take a look here: http://docs.splunk.com/Documentation/Splunk/6.2.2/SearchReference/Collect

SGF
0 Karma

clyde772
Communicator

Stephanefotso, thanks for the reply! Of course I have tried that, but with real-time search, it wound not write the results until I stop the search. I am trying to make it to just stream into an index, as a real-time search crunches out the rows. Let me know if you have any other thoughts.

Appreciate it!

0 Karma

stephanefotso
Motivator

Surprising! OK annother way to do it is to create an alert, wich, wen triggered, populate a summary index you have created. You can set a condition for the alert to be triggered as when the number of events is greatter than 0, or setup a Real Time alert. i did it and it is working perfectly!
Let me know your impression!

SGF

clyde772
Communicator

Stephanefotso, That's a great idea. It's great, how we can tweak Splunk to do anything huh? Thanks! Let me give it a shot!

0 Karma

joy76
Path Finder

Hi
I tried it. But failed. Im using splunk 6.1.9.
Is Splunk version wrong?

0 Karma
Get Updates on the Splunk Community!

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...

Splunk AppDynamics Agents Webinar Series

Mark your calendars! On June 24th at 12PM PST, we’re going live with the second session of our Splunk ...

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...