indexed fields are not creating while events are collected into summary index by using collect command

[nagendraDumpala]

Hi,

we configured transform.conf, props.conf and fields.conf file while pushing the events into main index. In that time indexed fields are created and when using tstats command is also working fine.

No we are trying to move the search matched events into summary index from main index by using collect command. In this time our main indexed fields are coming into the summary index but, those fields are not acting as indexed fields in summary index. And when we are try to use tstats on summary index also not working on those fields.

Can you please help us to resolve this problem. What we need is, the collected fields also act as indexed fields in summary index.

Please correct us if we missing something.

Thanks & Reguards

Nagendra D

[richgalloway]

For a brief description of how to create index-time fields in your summary index,  see the slide titled "Workaround: Stats -> SI + Index Time -> tstats " at https://conf.splunk.com/files/2017/slides/searching-fast-how-to-start-using-tstats-and-other-acceler...

Also, consider using an accelerated data model as an alternative.