Splunk Enterprise

indexed fields are not creating while events are collected into summary index by using collect command



we configured transform.conf, props.conf and fields.conf file while pushing the events into main index. In that time indexed fields are created and when using tstats command is also working fine.

No we are trying to move the search matched events into summary index from main index by using collect command. In this time our main indexed fields are coming into the summary index but, those fields are not acting as indexed fields in summary index. And when we are try to use tstats on summary index also not working on those fields.

Can you please help us to resolve this problem. What we need is, the collected fields also act as indexed fields in summary index.

Please correct us if we missing something.


Thanks & Reguards

Nagendra D

Labels (1)
0 Karma


For a brief description of how to create index-time fields in your summary index,  see the slide titled "Workaround: Stats -> SI + Index Time -> tstats " at https://conf.splunk.com/files/2017/slides/searching-fast-how-to-start-using-tstats-and-other-acceler...

Also, consider using an accelerated data model as an alternative.

If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Splunk Cloud | Empowering Splunk Administrators with Admin Config Service (ACS)

Greetings, Splunk Cloud Admins and Splunk enthusiasts! The Admin Configuration Service (ACS) team is excited ...

Tech Talk | One Log to Rule Them All

One log to rule them all: how you can centralize your troubleshooting with Splunk logs We know how important ...

Splunk Security Content for Threat Detection & Response, Q1 Roundup

Join Principal Threat Researcher, Michael Haag, as he walks through: An introduction to the Splunk Threat ...