Hi there,
I have an computationally expensive query which is (manually) run on the main index. Instead of running it every time I would like to send the output of this search to another index where the output can be seen and further analysis can be done.
Is it possible to take the output of a search on one index, and feed it as input to another index? Can such a search be scheduled?
Many thanks !
jim
When you ran the first collect command did it complete? When you run the new command, did you select all-time? I just tried it without issue. You can ignore the informational messages.
Thanks for your quick response dmaislin !
Here is what I did:
I got the following messages in the message area (just below the search input area):
7,813 matching events
"Successfully wrote file to '1039324343_events.stash_new'."
"Changing file extension to .stash_new for file=$random$_events.stash"
Next, I did the following search
"No matching events found"
In all of the above cases, the time range was set to 'All time'.
I think you can use the collect command to do just that.
Thanks for the quick response. I tried index=main
I noticed some informational messages indicating that some temporary file(s) had been created.
However, if I do the following search
index=
It is as if the collect failed to add the search output into the other index.
I ensured that