Modify source name while summary indexing data

[angelinealex]

I have a saved search called searchA. I am scheduling this saved search and summary indexing the data. After the scheduler runs i am seeing the source value as searchA (source=searchA). But I would like to have the source value as searchX (source=searchX).

How to achieve it when the scheduler runs or do I have option to change the source name in searchA code itself, so that it can be picked up when the saved search runs?

Can someone help me?

[adonio]

hello there,

you can leverage collect command to put results in summary indexes and overwrite the source
.... your search | collect index =<index_name> source=<source_name>
read here more:
http://docs.splunk.com/Documentation/Splunk/7.1.1/SearchReference/Collect

hope it helps

[angelinealex]

thanks for the response. It works. But it adds the data into summary index when I just run the saved search. I mean run the below query in the search box.

.... my search | collect index =<index_name> source=<source_name>

Can we control that to modify the source only when the saved search executes during the schedule time? Or is there any other way to change the source name only when the savedsearch executes during scheduled time?

[adonio]

not sure exactly what you mean.
a search, scheduled or not, populates the summery index.
convert your saved search to the format above and save it to meet your requirements.
hope i understood your comment

[angelinealex]

well.. When we use collect, if someone, by mistake runs the saved search (through open in search option) the data will be summary indexed. I would like to avoid this.

So I want to summary index the data only by scheduling the saved search and change the source_name.

Please let me know if I am not clear.

[richgalloway]

There is no way to change the behavior of a search based on whether it was scheduled or not. The collect command will always write to the summary index (unless the testmode option is enabled) every time the search executes.

[adonio]

how does that different form sistats or whatever you are doing today?
i feel like i already answered how to rename the source field when summarizing data via search. if not, please elaborate, as i probably did not understand your question