Can you help me with scheduling a report which collects data for a summary index?

[splunkannm]

I want to schedule a report daily that collects data into a summary index.

eg :

index= abc |table a b c |collect index =

However, I want the data to be added and not replaced every time the report is run. For eg, if there are two events generated on day 1 and three events generated by the search on day 2, on day 3, before the report runs, there should be 5 events in total for the summary index.

How do I avoid this replacement of index when scheduling?

[Vijeta · Accepted solution]

Hi,

The events are always added when you use collect statement and not replaced. Can you provide more details on the requirement?

Thanks