Splunk Enterprise

How to insert data correctly with collect command (include fields and values)?

jordilazo
Explorer

Hi,

I'm pretty new to splunk and I have a question.

I am trying to send information from one index to another with the "collect" command.

The problem is that when I send the events to the new index the field and value do not appear as in the old index (they disappear).

I am using this sentence:

 

index = legacy sourcetype = old_legacy | collect index= mew_legacy

 

 

But in the new index i'm not receiving the FIELD->VALUE .

Labels (2)
0 Karma
1 Solution

johnhuang
Motivator

Make sure you define all the fields and values to be indexed.

 

<base search>
| table field1 field2 field3 ... 
| collect index=<new_index>

View solution in original post

johnhuang
Motivator

Make sure you define all the fields and values to be indexed.

 

<base search>
| table field1 field2 field3 ... 
| collect index=<new_index>

jordilazo
Explorer

Thank you. That was what was missing

0 Karma
Get Updates on the Splunk Community!

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...

Splunk AppDynamics Agents Webinar Series

Mark your calendars! On June 24th at 12PM PST, we’re going live with the second session of our Splunk ...

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...