Splunk Enterprise

How to insert data correctly with collect command (include fields and values)?

jordilazo
Explorer

Hi,

I'm pretty new to splunk and I have a question.

I am trying to send information from one index to another with the "collect" command.

The problem is that when I send the events to the new index the field and value do not appear as in the old index (they disappear).

I am using this sentence:

 

index = legacy sourcetype = old_legacy | collect index= mew_legacy

 

 

But in the new index i'm not receiving the FIELD->VALUE .

Labels (2)
0 Karma
1 Solution

johnhuang
Motivator

Make sure you define all the fields and values to be indexed.

 

<base search>
| table field1 field2 field3 ... 
| collect index=<new_index>

View solution in original post

johnhuang
Motivator

Make sure you define all the fields and values to be indexed.

 

<base search>
| table field1 field2 field3 ... 
| collect index=<new_index>

jordilazo
Explorer

Thank you. That was what was missing

0 Karma
Get Updates on the Splunk Community!

ATTENTION!! We’re MOVING (not really)

Hey, all! In an effort to keep this Slack workspace secure and also to make our new members' experience easy, ...

Splunk Admins: Build a Smarter Stack with These Must-See .conf25 Sessions

  Whether you're running a complex Splunk deployment or just getting your bearings as a new admin, .conf25 ...

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...