Send alerts data to new index using collect command

[iamsplunker]

Hi Splunkers

I'm trying to send alerts data from one index to another using a macro
For ex: The macro is having 4 arguments like below and would like to send data to new index called "newidx" using collect command

here is the macro called `newmacro`
eval apple=xyz, banana=abc, mango=www, grape=123 | collect index=newidx

the idea is wherever I reference this macro in an alert that exact alert raw data need to be copied to the newidx but the sourcetype always changes as stash instead of original. I don't see all original fields in summary index

Is there any way to define a sourcetype something like |collect index=newidx sourcetype=$sourcetype$

[_JP]

The collect command does allow you to define a sourcetype.  Note that the stash sourcetype is special as it doesn't hit your license volume.  When you use collect with a different sourcetype Splunk considers it "new" data since you may not be generating summarizing statistics on data already indexed.

Also, since this is tied to an alert, would using the Log Event Alert Action be sufficient?

[iamsplunker]

@_JP thanks for your response. I'm not trying to define a new sourcetype here. Instead I want the same sourcetype to be collected from search.

I cannot define the custom sourcetype after collect command because the sourcetype varies based on the type of alert/alertname.

I want to reference this macro in most of the alerts!

[_JP]

Are you collecting events from a lot of different sourcetypes?  If you just have one sourcetype per alert can you pass it into the macro like you would other parameters?

I configured a macro like the following:

And then was able to use it like this:

index=_internal earliest=-15m | stats count by component | `collect_macro(the_index=summary,the_sourcetype=special_sourcetype)`

And then in my summary index I saw stuff appear with the special_sourcetype instead of stash: