Hello guys.
Hope someone can help us out.
I am using the Enterprise and am trying to store the events after CIM mapping (via Data Model) to the S3 bucket but it doesn't seem to be possible to be configured on the Splunk side.
My current approach is that I have created the Scheduled Search with Report and stream the results to the summary_index. Also I created Ingest Action to stream all incoming events from summary_index to the S3.
The workflow works fine just expect we get the same raw events written to the S3 and what we want - is to have MAPPED events stored to S3.
Do you know if/how we can stream mapped events from one index into another?
Some more details:
The reason behind it is that raw event has nested collections that we would like to reconfigure before giving back to the user. That's why initial thought was to implement logic that:
1 Our_Service sends data to Splunk
2 Splunk performs needed mapping and send mapped data to S3
3 Our_Service queries the bucket to get that formatted data
I was also trying to reuse the same tstats search as we do for the dashboard but eventually that becomes a table and won't show the events but rather table in statistics so the summary_index stays empty in that case.
Any help is highly appreciated
