Hello @bowesmana Q: Are you collecting a _raw field or are you collecting fields without _raw? >> I am not sure what you meant, my understanding _raw is the one that got pushed to index=summary Q: Are you specifying an index to collect to? What's your collect command? I figured out why collect command didn't push the data. I put the wrong index name. I stroke the incorrect name below | collect index= summary summary_test_1 testmode=false file=summary_test_1.stash_new name=summary_test_1" marker="report=\"summary_test_1\"" Q:Are you running this as an ad-hoc search or as a scheduled saved search? I ran this as an ad-hoc search as a proof of concept using the past time Once it's working I will use a scheduled saved search for future time I added your suggestion to my search below and it worked, although I don't completely understand how. Note that addtime=true/false didn't make any difference I appreciate your help. Thank you. If you have an easier way, please suggest 🙂 index=original_index
``` Query ```
| addinfo
| eval _raw=printf("_time=%d", info_max_time)
| foreach "*"
[| eval _raw=_raw.case(isnull('<<FIELD>>'),"",
mvcount('<<FIELD>>')>1,", <<FIELD>>=\"".mvjoin('<<FIELD>>',"###")."\"",
true(), ", <<FIELD>>=\"".'<<FIELD>>'."\"")
| fields - "<<FIELD>>" ]
table ID, name, address
| collect index= summary testmode=false addtime=true file=summary_test_1.stash_new name=summary_test_1" marker="report=\"summary_test_1\""
... View more
