Collect Command

[ManishaAgrawal]

Is it possible to use collect command to collect data from one index and move it to another, where destiation index is not a summary index ?

index=whatever host=whatever source=whatever whatever | collect index=foo

Where foo is pre-configured index in indexes.conf.

[ManishaAgrawal]

Thanks Alacercogitatus

Could you please highlight what summary data would be indexed.

[alacercogitatus · Accepted solution]

Sure. I don't think collect really cares where it gets dumped, just be aware that there will probably be some summary data within the dumped information.

[linu1988]

some extra fields will be added to the orinal index. you are going to loose event structure, host will change to local splunk instance name. you can see by using a single event collect. Rather than using collect you could copy the buckets.

http://answers.splunk.com/answers/118518/is-it-possible-to-divide-an-index-to-two-indexes?page=1&foc...

[ManishaAgrawal]

Thanks Alacercogitatus

Could you please highlight what summary data would be indexed.