Save results of saved search back into an index.

[johnsasikumar]

Can we save results of a saved search/ search back into splunk. Something similar to a view in SQL database.
Splunk query processes the raw data(Scheduled)--> saves it back to an index.

[renjith_nair]

@johnsasikumar,

There are possibly two ways of doing it. Based on your use case, you could choose the better suited one

1 - Using Log events

Using the alert actions, you could send the log events to your splunk deployment for indexing

2 - Summary indexing

With summary indexing, you set up a frequently-running search that extracts the precise information you want. Each time this search is run, its results are saved into a summary index that you designate. You can then run searches and reports on this significantly smaller (and thus seemingly "faster") summary index

https://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Usesummaryindexing