Splunk Search

How to stream real-time search results into a summary index or another index?

clyde772
Communicator

I had some pre-processing requirement using splunk real-time search, so once I put together those results, I would like to stream the results of the real-time search in another index. I couldn't figure out a way to do it, so I ended up writing a python script that kicks off a real-time search and pipes the results as scripted input.

There's gotta be a better way of doing this! Anybody had similar demands?

0 Karma
1 Solution

stephanefotso
Motivator

Try the collect command. something like this:

   ............ | collect index=newindex

For more informations, take a look here: http://docs.splunk.com/Documentation/Splunk/6.2.2/SearchReference/Collect

SGF

View solution in original post

0 Karma

stephanefotso
Motivator

Try the collect command. something like this:

   ............ | collect index=newindex

For more informations, take a look here: http://docs.splunk.com/Documentation/Splunk/6.2.2/SearchReference/Collect

SGF
0 Karma

clyde772
Communicator

Stephanefotso, thanks for the reply! Of course I have tried that, but with real-time search, it wound not write the results until I stop the search. I am trying to make it to just stream into an index, as a real-time search crunches out the rows. Let me know if you have any other thoughts.

Appreciate it!

0 Karma

stephanefotso
Motivator

Surprising! OK annother way to do it is to create an alert, wich, wen triggered, populate a summary index you have created. You can set a condition for the alert to be triggered as when the number of events is greatter than 0, or setup a Real Time alert. i did it and it is working perfectly!
Let me know your impression!

SGF

clyde772
Communicator

Stephanefotso, That's a great idea. It's great, how we can tweak Splunk to do anything huh? Thanks! Let me give it a shot!

0 Karma

joy76
Path Finder

Hi
I tried it. But failed. Im using splunk 6.1.9.
Is Splunk version wrong?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...