Output of search as input to another index

[splunker_jim]

Hi there,

I have an computationally expensive query which is (manually) run on the main index. Instead of running it every time I would like to send the output of this search to another index where the output can be seen and further analysis can be done.

Is it possible to take the output of a search on one index, and feed it as input to another index? Can such a search be scheduled?

Many thanks !

jim

[dmaislin_splunk]

When you ran the first collect command did it complete? When you run the new command, did you select all-time? I just tried it without issue. You can ignore the informational messages.

[splunker_jim]

Thanks for your quick response dmaislin !

Here is what I did:

1. index=main source=blah | collect index=

I got the following messages in the message area (just below the search input area):

7,813 matching events
"Successfully wrote file to '1039324343_events.stash_new'."
"Changing file extension to .stash_new for file=$random$_events.stash"

Next, I did the following search

1. index= In the search result pane, I see the following message:

"No matching events found"

In all of the above cases, the time range was set to 'All time'.

[dmaislin_splunk]

I think you can use the collect command to do just that.

[splunker_jim]

Thanks for the quick response. I tried index=main | collect index=

I noticed some informational messages indicating that some temporary file(s) had been created.

However, if I do the following search
index=, I do not see any results.

It is as if the collect failed to add the search output into the other index.

I ensured that was already created before running any of the above commands. I used all default options when creating this index.