How to summary index data in a saved search scheduled to run every hour to a particular index based on a attribute in a saved search?

[rmuraly]

I have a saved search that returns me the following event data :

Event 1 :
source=TRDF_1453, Filed1=TEST_DATA, Field2=TEST_D1, Field3=Test_D3

Event 2 :
source=TRDF_1494, Filed1=TEST_DATA, Field2=TEST_D1, Field3=Test_D3

Event 3 :
source=TRDF_1453, Filed1=TEST_DATA, Field2=TEST_D1, Field3=Test_D3

In the scenario above summary indexing this saved search should
1. move Event 1 and Event 3 to index gn_data_TRDF_X
2. move Event 2 to index gn_data_TRDF_Y

I make this decision based on 'source' field. If 'source' matches move them to under one index.

Is there any way I can do this in Splunk?

[somesoni2]

Create two summary index searches, one looking for source=TRDF_1453 and summary indexing to gn_data_TRDF_X index, other one looking for source=TRDF_1494 and summary indexing to gn_data_TRDF_Y index.

[rmuraly]

This is the approach I am currently taking .. but Can this be done using one single summary index and dynamically choose the index to summary index?

[somesoni2]

I got one untested approach. Update your summary index search like this. Do remember to remove summary index option from saved search as we're doing it using collect command in search.

your current search 
| appendpipe [| where source="TRDF_1453" | collect index="gn_data_TRDF_X" sourcetype="ST You want to use"]
| appendpipe [| where source="TRDF_1494" | collect index="gn_data_TRDF_Y" sourcetype="ST You want to use"]

[rmuraly]

yeup. This works for me.