How to stream real-time search results into a summary index or another index?

[clyde772]

I had some pre-processing requirement using splunk real-time search, so once I put together those results, I would like to stream the results of the real-time search in another index. I couldn't figure out a way to do it, so I ended up writing a python script that kicks off a real-time search and pipes the results as scripted input.

There's gotta be a better way of doing this! Anybody had similar demands?

[stephanefotso · Accepted solution]

Try the collect command. something like this:

   ............ | collect index=newindex

For more informations, take a look here: http://docs.splunk.com/Documentation/Splunk/6.2.2/SearchReference/Collect

[clyde772]

Stephanefotso, thanks for the reply! Of course I have tried that, but with real-time search, it wound not write the results until I stop the search. I am trying to make it to just stream into an index, as a real-time search crunches out the rows. Let me know if you have any other thoughts.

Appreciate it!

[stephanefotso]

Surprising! OK annother way to do it is to create an alert, wich, wen triggered, populate a summary index you have created. You can set a condition for the alert to be triggered as when the number of events is greatter than 0, or setup a Real Time alert. i did it and it is working perfectly!
Let me know your impression!

[clyde772]

Stephanefotso, That's a great idea. It's great, how we can tweak Splunk to do anything huh? Thanks! Let me give it a shot!

[joy76]

Hi
I tried it. But failed. Im using splunk 6.1.9.
Is Splunk version wrong?