Ok. We need to get the terminology straight. 1. There is no such thing as "summary index" as a type of index. Splunk has only two types of indexes - events and metrics. You can have a summary index as an index which gets your summaries but it's purely organizational issue. 1a. You can have have both summary events and any other kind of events in the same index. 2. There is summary indexing meaning a process in which you generate data which is saved into your indexes for summarizing purposes. 3. There is no such thing as commands in the index. Searches can read from an index and write to them but they are not in an index. So you're either using collect explicitly or it's done implicitly as a result of summary indexing option in scheduled search. 4. Indexes just hold data. They don't do anything with it. The data is either permanently transformed before being written to the index (that's what happens when the data is collected to the summary index) or is being dynamically transformed on read according to sourcetype/source/host definition (in your case it's the definition for the stash sourcetype). Index has nothing to do with it. The summary indexing in the scheduled search works the same way as the collect command does - the results are getting written to an intermediate csv file from which they are ingested into the destination index. But here you can't decide on the details as you can do with the manually spawned collect command. So either fiddle with the configuration described in the article I linked (might work, might not; haven't tried it myself), manually split the results on search (but that might be problematic if you have spaces in your field values; in such case you could try to delimit multivalued fields differently before collecting) or split your events so that you don't have multivalued fields before collecting the summaries.