I had some pre-processing requirement using splunk real-time search, so once I put together those results, I would like to stream the results of the real-time search in another index. I couldn't figure out a way to do it, so I ended up writing a python script that kicks off a real-time search and pipes the results as scripted input.
There's gotta be a better way of doing this! Anybody had similar demands?
Try the collect command. something like this:
............ | collect index=newindex
For more informations, take a look here: http://docs.splunk.com/Documentation/Splunk/6.2.2/SearchReference/Collect
Try the collect command. something like this:
............ | collect index=newindex
For more informations, take a look here: http://docs.splunk.com/Documentation/Splunk/6.2.2/SearchReference/Collect
Stephanefotso, thanks for the reply! Of course I have tried that, but with real-time search, it wound not write the results until I stop the search. I am trying to make it to just stream into an index, as a real-time search crunches out the rows. Let me know if you have any other thoughts.
Appreciate it!
Surprising! OK annother way to do it is to create an alert, wich, wen triggered, populate a summary index you have created. You can set a condition for the alert to be triggered as when the number of events is greatter than 0, or setup a Real Time alert. i did it and it is working perfectly!
Let me know your impression!
Stephanefotso, That's a great idea. It's great, how we can tweak Splunk to do anything huh? Thanks! Let me give it a shot!
Hi
I tried it. But failed. Im using splunk 6.1.9.
Is Splunk version wrong?