https://community.splunk.com/t5/Splunk-Search/How-to-use-quot-collect-quot-and-keep-the-timestamp-and-field/m-p/102458#M26476 <P>The problem was that the _raw field came from a database and were not prefixed by a timestamp. So what I did in the end was add the following to prepend it:</P> <PRE><CODE>my search | eval _raw=_time + ": " + _raw | collect index=summary </CODE></PRE> <P>I don't have any way of adding the field extractions though that can be done at search time manually.</P> Mon, 22 Jul 2013 13:11:35 GMT jameshgibson 2013-07-22T13:11:35Z https://community.splunk.com/t5/Splunk-Search/How-to-use-quot-collect-quot-and-keep-the-timestamp-and-field/m-p/102457#M26475 <P>So I have used collect to save some events into a summary index. The problem is all of the timestamp information is lost which makes the info next to useless. It desides to default all the events to the search time.</P> <P>It also drops all the field extractions that I set up which is a pain but can be worked around at a push.</P> <P><STRONG>pseudo search:</STRONG> </P> <PRE><CODE>sourcetype=x my_field=name | rex=something "do_some_extractions" | collect index=summary </CODE></PRE> Mon, 22 Jul 2013 10:15:15 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-quot-collect-quot-and-keep-the-timestamp-and-field/m-p/102457#M26475 jameshgibson 2013-07-22T10:15:15Z https://community.splunk.com/t5/Splunk-Search/How-to-use-quot-collect-quot-and-keep-the-timestamp-and-field/m-p/102458#M26476 <P>The problem was that the _raw field came from a database and were not prefixed by a timestamp. So what I did in the end was add the following to prepend it:</P> <PRE><CODE>my search | eval _raw=_time + ": " + _raw | collect index=summary </CODE></PRE> <P>I don't have any way of adding the field extractions though that can be done at search time manually.</P> Mon, 22 Jul 2013 13:11:35 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-quot-collect-quot-and-keep-the-timestamp-and-field/m-p/102458#M26476 jameshgibson 2013-07-22T13:11:35Z https://community.splunk.com/t5/Splunk-Search/How-to-use-quot-collect-quot-and-keep-the-timestamp-and-field/m-p/102459#M26477 <P>You sir are a genius!<BR /> I know this is an old post, but this is the only solution I've come across that fully solves the issue.<BR /> Pretty much every other post has some variation of | eval EventTime = _time, which is a decent workaround but doesn't preserve the _time field.</P> Tue, 16 Jan 2018 00:11:22 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-quot-collect-quot-and-keep-the-timestamp-and-field/m-p/102459#M26477 LeeSart 2018-01-16T00:11:22Z