Splunk Search

Is it possible to use multiple collects to send data to different indexes?

moses_meniscus
Explorer

Is it possible to use the collect function to send data to multiple different summary indexes?

For example, let's say my search produces the following results:

date         org         field1   field2    field3
03-15-22 Finance valueA1 ValueA2 ValueA3
03-15-22 Maintenance valueB1 ValueB2 ValueB3

I want to use collect to send the results for org:Finance to a specific summary index = FinanceSummary and similarly send the results for org:Maintenance to another summary index=MaintenanceSummary

The syntax I have for the collect function was:

|collect index=[the target summary index]


My question is there way I can do something like:

| where org=Finance
| collect index=FinanceSummary
| where org=Maintenance
| collect index=MaintenanceSummary

I was not sure if this was possible and was hoping to check before pollute my summary indexes with bad results. The documentation itself does not explicitly address this question unfortunately 
https://docs.splunk.com/Documentation/Splunk/8.2.5/SearchReference/Collect

Thanks in advance!

0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

This won't work, not because of the multiple collects, which should work, but because the first where command will remove everything apart from org=Finance, so when the second where command removes everything apart from org=Maintenance, there will be no results left (since the org=Maintenance events were removed by the first where command).

View solution in original post

moses_meniscus
Explorer

Thanks for the reply! That makes perfect sense. Someone outside of this channel suggested I try a foreach loop. But thanks for confirming my original question!

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

This won't work, not because of the multiple collects, which should work, but because the first where command will remove everything apart from org=Finance, so when the second where command removes everything apart from org=Maintenance, there will be no results left (since the org=Maintenance events were removed by the first where command).

Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...

Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain

Boston may be buzzing this September with Splunk University and .conf25, but you don’t have to pack a bag to ...

Splunk Lantern’s Guide to The Most Popular .conf25 Sessions

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...