Splunk Enterprise

How to insert data correctly with collect command (include fields and values)?

jordilazo
Explorer

Hi,

I'm pretty new to splunk and I have a question.

I am trying to send information from one index to another with the "collect" command.

The problem is that when I send the events to the new index the field and value do not appear as in the old index (they disappear).

I am using this sentence:

 

index = legacy sourcetype = old_legacy | collect index= mew_legacy

 

 

But in the new index i'm not receiving the FIELD->VALUE .

Labels (2)
0 Karma
1 Solution

johnhuang
Motivator

Make sure you define all the fields and values to be indexed.

 

<base search>
| table field1 field2 field3 ... 
| collect index=<new_index>

View solution in original post

johnhuang
Motivator

Make sure you define all the fields and values to be indexed.

 

<base search>
| table field1 field2 field3 ... 
| collect index=<new_index>

jordilazo
Explorer

Thank you. That was what was missing

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...