The use case I am after is to build a summary index that includes all interesting fields (system TAs and keys from lookups) just like they appear when issuing the search in the search bar. The console searches include all normalized fields from TAs such as the alias of dest_ip->dest as well as my lookup key/val pairs but these fields are not preserved in the summary index.
I am using lookups to sift through very large datasets and the resultant matches are a very very small percentage of the original dataset. This subset, based on identification by the lookups, is what I want to work with. MY_FIELD1 tells me that there was a match then the lookup adds another 20 key/value pairs of context (MY_FIELD2, MY_FIELD3, etc).
Example scheduled search every 15 min:
MY_FIELD1=* earliest=-30m latest=-15m|fields dest,src,MY_* | collect index=summary
RESULT from search bar - results include MY_* fields, dest, src, etc.
RESULT in index (summary) - includes only host, source, sourcetype, index, linecount, splunk_server, and timestamp. It is missing MY_* fields, dest, src, etc.
In summary - I am trying to build an index of events that include all normalized fields and lookup context such that I can search very quickly through this small subset of data rather than having to repeatedly search by applying lookups against a gigantic dataset. Thanks in advance.
... View more
I am trying to use an external script (python) to retrieve data from a database (sqlite3) which is to be summarized within a dashboard. The python script is within a wrapper. command.conf in /default is detailed below. script is in the /bin dir. Runnning "|dumpTS" with the app search, I get "Unknown search command 'dumpts'." The script takes no input and returns column headers (csv delimited) and the associated rows of csv formatted data. Any ideas?
filename = dumpTS.py
generating = true
local = true
maxinputs = 0
... View more