Getting Data In

How to run a search of data in one index and update data in another index if the certain parameters are met

BrandSentiment
Explorer

I would like to run a search of data in one index and update data in another index if the certain parameters are met.

Index1 holds semi-static data for user profiles. The index2 is holds streaming data coming in from the comments stream. What I would like to do is update the profile data interests field by adding football as an interest if the comment stream contains "football" .

Can I run a query against a username along these lines:

if index=index2 username= username AND comment.content="football" THEN index=index1 username= username ADD football to username.interest

I am sure there is a better way of doing this and really appreciate any help anyone could give.

Thank you

0 Karma

MuS
SplunkTrust
SplunkTrust

Hi BrandSentiment,

take a look at the collect command http://docs.splunk.com/Documentation/Splunk/6.1.4/SearchReference/Collect
This will put the search result into the specified index. So running somehting like this should do the job:

index=index2 username=username AND comment.content="football" | colect index=index1

Hope this helps ...

cheers, MuS

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...