Is it possible to use the collect function to send data to multiple different summary indexes? For example, let's say my search produces the following results:
date org field1 field2 field3 03-15-22 Finance valueA1 ValueA2 ValueA3 03-15-22 Maintenance valueB1 ValueB2 ValueB3
I want to use collect to send the results for org:Finance to a specific summary index = FinanceSummary and similarly send the results for org:Maintenance to another summary index=MaintenanceSummary The syntax I have for the collect function was:
|collect index=[the target summary index]
My question is there way I can do something like:
| where org=Finance | collect index=FinanceSummary | where org=Maintenance | collect index=MaintenanceSummary
I was not sure if this was possible and was hoping to check before pollute my summary indexes with bad results. The documentation itself does not explicitly address this question unfortunately https://docs.splunk.com/Documentation/Splunk/8.2.5/SearchReference/Collect
Thanks in advance!
... View more