Thanks! This does work too! I will compare the two searches to see if there are any differences! ... View more

I noticed that I only received this error for the 5 minute interval. I actually, uninstalled this app, reinstalled, and made the changes above, and then ran it for the first time, including the back fill. It seems to be happy now. The splunk start up script also stated that there was a possible typo in the macros.conf file, so I deleted the "~" at the end of the file. I am not sure if that was supposed to be there, but again, it seems happier now. ... View more

No - It will copy the data from your source index to the new one specified by the collect command. It will not remove data from the original index. You can use (with great care) the |delete command to remove the items from the source DB, but you should be aware that this only prevents the results being returned in search - the events themselves will remain on disk. In many cases this is acceptable, but if your dealing with some sensitive data types, the only way to remove events once indexed is to expire/freeze your index and let Splunk delete the buckets ... View more