Splunk Search

How to force a scripted input to be run at search time, in order to use remote data?

drodman29
Path Finder

I'm writing a health check dashboard and I want to invoke one of my normal input scripts, on demand, at the time the search is run and use the data collected in the dashboard chart. It seems that inputs are totally divorced from the input/ingestion processes so I can schedule the input any time I want, but I can't force the input to occur at search time - Is this correct?

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

You may be looking at custom search commands. You can create a generating command to retrieve data from remote system and use it in SPL. See more information here:

http://dev.splunk.com/view/python-sdk/SP-CAAAEU2
https://docs.splunk.com/Documentation/Splunk/6.5.1/Search/Aboutcustomsearchcommands

View solution in original post

0 Karma

hunters_splunk
Splunk Employee
Splunk Employee

Hi drodman29,

The short answer is NO - data must be collected and indexed first before they can be searched, not the other way around. Performing a search to trigger data input would be like putting cart before a horse.

The Splunk data pipeline is explained here in detail: http://docs.splunk.com/Documentation/Splunk/6.5.1/Deploy/Datapipeline

Hope this helps. Thanks!
Hunter

0 Karma

somesoni2
SplunkTrust
SplunkTrust

You may be looking at custom search commands. You can create a generating command to retrieve data from remote system and use it in SPL. See more information here:

http://dev.splunk.com/view/python-sdk/SP-CAAAEU2
https://docs.splunk.com/Documentation/Splunk/6.5.1/Search/Aboutcustomsearchcommands

0 Karma

drodman29
Path Finder

I'm looking into lookups as a way to invoke a script at search time, either way as a custom search command or a lookup it looks like py is the answer.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...