Getting Data In

How can I collect to generate more sample data?


I'm trying to perform a collect with the intention of making my data more heterogeneous. Meaning if I have data from only one host, I want to collect the same data but with a different host and some other different fields. Like _time for instance.

index=mock | eval _time = _time + 86400, cluster = "EDS" | collect index=mock host = "new_host"

So the new data comes with the same _raw and new host, but the _time field stays the same as the original, meaning I can't collect the data and tell that it belongs to the next day. The field cluster also does not get collected. Any ideas?

Tags (3)
0 Karma


In my experience with Splunk 6.6.x, the time fields applied via collect will default to the value of info_min_time, which is the earliest time of the search window. This is consistent with the documentation about collect.

I've had good luck using the addtime=false option with collect. You might play with that and see if it works for you. I've had conversations with other folks for whom it didn't work, but we weren't able to trace the root cause.

0 Karma


Hi @greggz,

I'm not sure cluster field directly indexed in index but I have tried to add it in _raw. Can you please try below search?

index=mock | eval _time = _time + 86400, _raw=_raw." cluster=\"EDS\"" | collect index=mock host = "new_host"


0 Karma



I believe that your best solution is to use eventgen.

The reason the field cluster doesn't show in the mock index is that collect gets only the _raw data into the new index (and allows you to change host and source and sourcetype which are metada fields), and cluster is a search time created field.

Collect is not intended for generating "sample" data. Check eventgen

0 Karma
Get Updates on the Splunk Community!

Devesh Logendran, Splunk, and the Singapore Cyber Conquest

At this year’s Splunk University, I had the privilege of chatting with Devesh Logendran, one of the winners in ...

There's No Place Like Chrome and the Splunk Platform

WATCH NOW!Malware. Risky Extensions. Data Exfiltration. End-users are increasingly reliant on browsers to ...

Customer Experience | Join the Customer Advisory Board!

Are you ready to take your Splunk journey to the next level? 🚀 We invite you to join our elite squad ...