Can we push data to summary index each time search runs and also when condition is met?

[vrmandadi]

Hello,

I have a alert which is scheduled to run every 10 minutes and triggers and alert if the number of events is greater than 0.Is there a way where we can push the data to summary index not just when the condition is met but everytime the search runs(10 minutes for this search) to store in the summary index.

I am using the below summary index to push data

| collect index="abc_summary" marker="report=abc_alerts" testmode=f addtime=t

[mattymo]

Hi vrmandadi!

Once you sechedule any search (an alert is just a scheduled search too!), you can go to settings > searches, reports & alerts > edit to control summary indexing options:

Collect also works appended to a scheduled search, but can be tricky to manage and can result in unwanted runs of the command. Check it out and let us know if this works for you!

http://docs.splunk.com/Documentation/SplunkCloud/latest/Knowledge/Usesummaryindexing#Set_up_summary_...