Archive

Does collect command remove data from source index?

Explorer

Does collect command remove data from source index?

Tags (1)
0 Karma

Explorer

Splunk Doc on collect command is a bit confusing:

source: http://docs.splunk.com/Documentation/Splunk/6.5.2/SearchReference/Collect#Moving_events_to_a_differe...

Moving events to a different index
You can use the collect command to move selected file content from one index to another index. Construct a search that returns the data you want to port, and pipe the results to the collect command. For example:

index=whatever host=whatever source=whatever whatever | collect index=foo

This search ports the data into the foo index. The sourcetype is changed to stash.

You can specify a sourcetype with the collect command. However, specifying a sourcetype counts against your license, as if you indexed the data again.

0 Karma

SplunkTrust
SplunkTrust

True. That section is actually describing "copying" the events to another place. It would require an additional step to delete them from the prior index.

0 Karma

Revered Legend

The collect command write the search results to an index, often called as summary index based on type query result people write using collect command. It doesn't affect any of the source index(ex).

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!