Splunk Search

Save results of saved search back into an index.

johnsasikumar
Path Finder

Can we save results of a saved search/ search back into splunk. Something similar to a view in SQL database.
Splunk query processes the raw data(Scheduled)--> saves it back to an index.

Tags (1)
0 Karma

renjith_nair
Legend

@johnsasikumar,

There are possibly two ways of doing it. Based on your use case, you could choose the better suited one

1 - Using Log events

Using the alert actions, you could send the log events to your splunk deployment for indexing

2 - Summary indexing

With summary indexing, you set up a frequently-running search that extracts the precise information you want. Each time this search is run, its results are saved into a summary index that you designate. You can then run searches and reports on this significantly smaller (and thus seemingly "faster") summary index

https://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Usesummaryindexing

---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...