How can I collect to generate more sample data?

[greggz]

I'm trying to perform a collect with the intention of making my data more heterogeneous. Meaning if I have data from only one host, I want to collect the same data but with a different host and some other different fields. Like _time for instance.

index=mock | eval _time = _time + 86400, cluster = "EDS" | collect index=mock host = "new_host"

So the new data comes with the same _raw and new host, but the _time field stays the same as the original, meaning I can't collect the data and tell that it belongs to the next day. The field cluster also does not get collected. Any ideas?

[elliotproebstel]

In my experience with Splunk 6.6.x, the time fields applied via collect will default to the value of info_min_time, which is the earliest time of the search window. This is consistent with the documentation about collect.

I've had good luck using the addtime=false option with collect. You might play with that and see if it works for you. I've had conversations with other folks for whom it didn't work, but we weren't able to trace the root cause.

[kamlesh_vaghela]

Hi @greggz,

I'm not sure cluster field directly indexed in index but I have tried to add it in _raw. Can you please try below search?

index=mock | eval _time = _time + 86400, _raw=_raw." cluster=\"EDS\"" | collect index=mock host = "new_host"

Thanks

[tiagofbmm]

Hey

I believe that your best solution is to use eventgen.

The reason the field cluster doesn't show in the mock index is that collect gets only the _raw data into the new index (and allows you to change host and source and sourcetype which are metada fields), and cluster is a search time created field.

Collect is not intended for generating "sample" data. Check eventgen

https://splunkbase.splunk.com/app/1924/