collect
This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Contents
collect
Synopsis
Puts search results into a summary index.
Syntax
collect index [arg-options]*
Required arguments
- index
- Syntax: index=<string>
- Description: Name of the index where Splunk should add the events. The index must exist for events to be added to it, the index is NOT created automatically.
Optional arguments
- arg-options
- Syntax: addtime=<bool> | file=<string> | spool=<bool> | marker=<string> | testmode=<bool> | run-in-preview=<bool>
- Description: Optional arguments for the collect command.
Collect options
- addtime
- Syntax: addtime=<bool>
- Description: If the search results you want to collect do not have a
_rawfield (such as results of stats, chart, timechart), specify whether to prefix a time field into each event. Specifying false means that Splunk will use its generic date detection against fields in whatever order they happen to be in the summary rows. Specifying true means that Splunk will use the search time rangeinfo_min_time(which is added by sistats) or_time. Splunk adds the time field based on the first field that it finds:info_min_time, _time, now(). Default is true.
- file
- Syntax: file=<string>
- Description: Name of the file where to write the events. Optional, default "<random-num>_events.stash". The following placeholders can be used in the file name $timestamp$, $random$ and will be replaced with a timestamp and a random number, respectively.
- ".stash" needs to be added at the end of the file name when used with "index=", if not the data will be added to the main index.
- marker
- Syntax: marker=<string>
- Description: A string, usually of key-value pairs, to append to each event written out. Optional, default is empty.
- run-in-preview
- Syntax: run-in-preview=<bool>
- Description: Controls whether the
collectcommand is enabled during preview generation. Generally, you do not want to insert preview results into the summary index, run-in-preview=false. In some cases, such as when a custom search command is used as part of the search, you might want to turn this on to ensure correct summary indexable previews are generated. Defaults to false.
- spool
- Syntax: spool=<bool>
- Description: If set to true (default is true), the summary indexing file will be written to Splunk's spool directory, where it will be indexed automatically. If set to false, file will be written to $SPLUNK_HOME/var/run/splunk.
- testmode
- Syntax: testmode=<bool>
- Description: Toggle between testing and real mode. In testing mode the results are not written into the new index but the search results are modified to appear as they would if sent to the index. (defaults to false)
Description
Adds the results of the search into the specified index. Behind the scenes, the events are written to a file whose name format is: events_random-num.stash, unless overwritten, in a directory which is watched for new events by splunk. If the events contain a _raw field then the raw field is saved, if they don't a _raw field is constructed by concatenating all the fields into a comma separated key=value pairs list.
Examples
Example 1: Put "download" events into an index named "downloadcount".
eventtypetag="download" | collect index=downloadcountSee also
overlap, sichart, sirare, sistats, sitop, sitimechart
Answers
Have questions? Visit Splunk Answers and see what questions and answers the Splunk community has using the collect command.
This documentation applies to the following versions of Splunk: 4.3 , 4.3.1 , 4.3.2 , 4.3.3 , 4.3.4 , 4.3.5 , 4.3.6 View the Article History for its revisions.