collect
This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
collect
Synopsis
Puts search results into a summary index.
Syntax
collect collect-index [collect-arg]*
Arguments
- collect-arg
- Syntax: <collect-addtime> | <collect-index> | <collect-file> | <collect-spool> | <collect-marker> | <collect-testmode>
- Description: None
- collect-index
- Syntax: index=<string>
- Description: name of the index where splunk should add the events to. Note: the index must exist for events to be added to it, the index is NOT created automatically.
Collect arg options
- collect-file
- Syntax: file=<string>
- Description: name of the file where to write the events to. Optional, default "<random-num>_events.stash" The following placeholders can be used in the file name $timestamp$, $random$ and will be replaced with a timestamp, a random number respectively
- collect-marker
- Syntax: marker=<string>
- Description: a string, usually of key-value pairs, to append to each event written out. Optional, default ""
- collect-spool
- Syntax: spool=<bool>
- Description: If set to true (default is true), the summary indexing file will be written to Splunk's spool directory, where it will be indexed automatically. If set to false, file will be written to $SPLUNK_HOME/var/run/splunk.
- collect-testmode
- Syntax: testmode=<bool>
- Description: toggle between testing and real mode. In testing mode the results are not written into the new index but the search results are modified to appear as they would if sent to the index. (defaults to false)
Description
Adds the results of the search into the specified index. Behind the scenes, the events are written to a file whose name format is: events_random-num.stash, unless overwritten, in a directory which is watched for new events by splunk. If the events contain a _raw field then the raw field is saved, if they don't a _raw field is constructed by concatenating all the fields into a comma separated key=value pairs list.
Examples
Example 1: Put "download" events into an index named "downloadcount".
eventtypetag="download" | collect index=downloadcount
See also
overlap, sichart, sirare, sistats, sitop, sitimechart
This documentation applies to the following versions of Splunk: 4.0 , 4.0.1 , 4.0.2 , 4.0.3 , 4.0.4 , 4.0.5 , 4.0.6 , 4.0.7 , 4.0.8 , 4.0.9 , 4.0.10 , 4.0.11 View the Article History for its revisions.