I use Splunks automated report facility for several reports - but I know have a requirement for a report that goes through several steps, creating and utilising lookup lists and delivering two distinct reports. The report flows is as follows:
Step 1: create a list of orders with the following - Buyers ID, Sellers ID, Products order, Order Status, Linked Order Reference
Step 2: Run same query as Step 1 except a lookup list of Linked Order Refernces is created
Step 3: List of Linked Order References is placed into another query and all Sellers ID associated with the Linked Orders are placed into another lookup list
Step 4: The list of Sellers IDs is placed into another query and a list of all orders and relevant information for these related to these Sellers IDs is created
Is it possible to automate this process using Splunk?
I think you may be able to use a summary index for this instead of all these lookups?
You could have multiple searches feed the available data into a larger index and then customize your report to run off that data with the fields you need already set.