Yes, that is what eval
and rex
do, among others.
http://docs.splunk.com/Documentation/Splunk/6.2.5/SearchReference/Eval
http://docs.splunk.com/Documentation/Splunk/6.2.5/SearchReference/Rex
If you mean that persist outside the scope of the run of your search, then you need to use outputcsv
followed by inputcsv
the next time around.
Yes, that is what eval
and rex
do, among others.
http://docs.splunk.com/Documentation/Splunk/6.2.5/SearchReference/Eval
http://docs.splunk.com/Documentation/Splunk/6.2.5/SearchReference/Rex
If you mean that persist outside the scope of the run of your search, then you need to use outputcsv
followed by inputcsv
the next time around.