A question about using the "collect" command.

[noott211]

index="my_index"
|eval check=if(html_code==200,"error","OK")
|stats count values(clientip) as src_ip by ip , check
|table src_ip , ip, check , count
|collect index=error_ip_count


I'm going to call up "error_ip_count" after using that command.
I used index=error_ip_count, but I couldn't call it up. Is there a wrong way to use it?

[noott211]

Thank you. Is there a better way to use collect?

[venkatasri · Accepted solution]

Hi @noott211 ,

Perhaps docs are starting point- https://docs.splunk.com/Documentation/Splunk/8.2.3/SearchReference/Collect

It depends on your use case and how you want to use it. At a high level it will write summary information( subset of _raw events) to a separate index.

[venkatasri]

Hi @noott211 

What do you mean by you couldn't call it up?

The above query should work just fine if the index=error_ip_count exist on indexers otherwise you need to create it.

---

An upvote would be appreciated if this reply helps!