Hello, Thank you for your explanation. 1) I ran the following search (without scheduled report): This will push the data from original index to summaryindex index=originalindex
```---- multip...
See more...
Hello, Thank you for your explanation. 1) I ran the following search (without scheduled report): This will push the data from original index to summaryindex index=originalindex
```---- multiple searches-----
table ID, name, address
```
| summaryindex spool=t uselb=t addtime=t index="summary" file="summary_test_1.stash_new" name="summary_test_1" marker="hostname=\"https://test.com/\",report=\"summary_test_1\"" 2) I ran index=summary report="summary_test_1" It gave me the data that contains ID, name, address It appeared that the first search pushed the data to index=summary report="summary_test_1", thus this command does not only tie to a scheduled report like you mentioned earlier So, what is the difference between summaryindex and collect if they provide the same function? Thanks