I am searching like this in Splunk:
| makeresults count=3 | eval _raw="demo event" | collect index=main sourcetype="sample"
It generates the events and also stores these 3 events in the index.
and then I searched this:
| makeresults count=3 | eval _raw="demo event" | collect index="randomindex" sourcetype="sample"
Here, "randomIndex" is not available in the Splunk instance, so it will not store the events, but it will show all 3 events anyway when the above search is fired. but still not stored anywhere.
I am trying same to do using REST API to search "makeresults" multiple times and store in the given index but there is no way to check whether the events has been stored successfully or not.
Is there a way to check whether the makeresults stored the event successfully or not.? using job properties or anything.?
... View more