What is the purpose of the sourcetype "stash_new"?

[lcavaliere_splu]

What is the purpose of the sourcetype "stash_new" as opposed to the "stash sourcetype?

[Amandeepsin]

Splunk automatically give this sourcetype. It doesn't cost us license and mentioning this stash it knows that license should not used while indexing summary index

[vishaltaneja070]

Basically it is used when you are doing summary indexing using collect command.
Data first get written to a stash_new file.
After that file processed based on sourcetype stash_new and stash.

[lcavaliere_splu]

When incoming summary data is being processed (e.g. from the collect command), the associated sourcetype is initially "stash_new". After the staging of this data is complete, it then is transformed to the sourcetype "stash".

Also of interest, this also means that any setting of TZ done under the "stash" sourcetype will get clobbered in that tranformation. This explains the workaround/solution provided in the following post:
https://answers.splunk.com/answers/717448/why-does-setting-a-tz-for-sourcetype-stash-not-tak.html?mi...