Summary Index - hostname appended on summary events

[stepheneardley]

We're summary indexing events from one index into another.  The original index contains JSON events e.g.

{"field1": "value1", "field2": "value2"}

The summary events all have a hostname value appended onto them e.g.

{"field1": "value1", "field2": "value2"}, hostname=abc

I found abc configured in alert_actions.conf under the email stanza;

[email]
hostname = abc

I can't figure out why this is happening and how to remove it from future summary events.  In advanced edit I can see a field called action.summary_index.hostname which contains "abc".  Is it simply inheriting the hostname parameter from alert_actions.conf?

I tried removing the value from this parameter and saving but when I go back into advanced edit the value is back.  This search cluster is quite mature (old...) so I wouldn't be happy simply removing that hostname parameter from alert_actions.conf and "hoping for the best".  I'm not sure where else it might be being used and what impact it could have on other users.

Any thoughts at all would be welcome here.

[DanielPriceUK]

you could use the collect command

https://docs.splunk.com/Documentation/SplunkCloud/8.2.2203/SearchReference/Collect

eg:
(table the field with the json data, I'll assume it's _raw

| table _raw
| collect index=<index name> output_format=hec