can I insert data from the search field to test search expressions with

[alexl1]

hello, I was wanting to do something like

insert "some test data key=value" | search ... 

No data would actually be inserted, I would just use in order to test search commands.

Thanks,

[curben]

makeresults can be used to generate search results. An example from the documentation.

| makeresults
| eval test="buttercup rarity tenderhoof dash mcintosh fleetfoot mistmane"
| makemv delim=" " test 
| mvexpand test

_time	test
2024-01-01 00:00:00	buttercup
2024-01-01 00:00:00	rarity
2024-01-01 00:00:00	tenderhoof
2024-01-01 00:00:00	dash
2024-01-01 00:00:00	mcintosh
2024-01-01 00:00:00	fleetfoot
2024-01-01 00:00:00	mistmane

Then you can use `search` or any other commands as usual.

| makeresults
| eval test="buttercup rarity tenderhoof dash mcintosh fleetfoot mistmane"
| makemv delim=" " test 
| mvexpand test
| search test="m*"

_time	test
2024-01-01 00:00:00	mcintosh
2024-01-01 00:00:00	mistmane

[lguinn2 · Accepted solution]

There is no command to insert data for testing. However, there are lots of ways to set up to test a search command:

1. Since search commands don't change any data, why not just search on the production system? Cut the time range back to "last 15 minutes" or "last 4 hours" to minimize the search time.
2. If you want to upload some test data, why not install a copy of free Splunk (or the trial license) on your laptop or desktop? Once you have a test instance set up, you can upload some real data and then use it to test your searches, etc. Or use some test data...
3. If you don't want to install a test server somewhere, you could create a test index and upload some data to it. Then just add index=test at the beginning of you search.

Would any of these options work?