Splunk Search

How to force a scripted input to be run at search time, in order to use remote data?

drodman29
Path Finder

I'm writing a health check dashboard and I want to invoke one of my normal input scripts, on demand, at the time the search is run and use the data collected in the dashboard chart. It seems that inputs are totally divorced from the input/ingestion processes so I can schedule the input any time I want, but I can't force the input to occur at search time - Is this correct?

0 Karma
1 Solution

somesoni2
Revered Legend

You may be looking at custom search commands. You can create a generating command to retrieve data from remote system and use it in SPL. See more information here:

http://dev.splunk.com/view/python-sdk/SP-CAAAEU2
https://docs.splunk.com/Documentation/Splunk/6.5.1/Search/Aboutcustomsearchcommands

View solution in original post

0 Karma

hunters_splunk
Splunk Employee
Splunk Employee

Hi drodman29,

The short answer is NO - data must be collected and indexed first before they can be searched, not the other way around. Performing a search to trigger data input would be like putting cart before a horse.

The Splunk data pipeline is explained here in detail: http://docs.splunk.com/Documentation/Splunk/6.5.1/Deploy/Datapipeline

Hope this helps. Thanks!
Hunter

0 Karma

somesoni2
Revered Legend

You may be looking at custom search commands. You can create a generating command to retrieve data from remote system and use it in SPL. See more information here:

http://dev.splunk.com/view/python-sdk/SP-CAAAEU2
https://docs.splunk.com/Documentation/Splunk/6.5.1/Search/Aboutcustomsearchcommands

0 Karma

drodman29
Path Finder

I'm looking into lookups as a way to invoke a script at search time, either way as a custom search command or a lookup it looks like py is the answer.

0 Karma
Get Updates on the Splunk Community!

Synthetic Monitoring: Not your Grandma’s Polyester! Tech Talk: DevOps Edition

Register today and join TekStream on Tuesday, February 28 at 11am PT/2pm ET for a demonstration of Splunk ...

Instrumenting Java Websocket Messaging

Instrumenting Java Websocket MessagingThis article is a code-based discussion of passing OpenTelemetry trace ...

Announcing General Availability of Splunk Incident Intelligence!

Digital transformation is real! Across industries, companies big and small are going through rapid digital ...