Deployment Architecture

Does collect command remove data from source index?

itmonitoring
Explorer

Does collect command remove data from source index?

Tags (1)
0 Karma

itmonitoring
Explorer

Splunk Doc on collect command is a bit confusing:

source: http://docs.splunk.com/Documentation/Splunk/6.5.2/SearchReference/Collect#Moving_events_to_a_differe...

Moving events to a different index
You can use the collect command to move selected file content from one index to another index. Construct a search that returns the data you want to port, and pipe the results to the collect command. For example:

index=whatever host=whatever source=whatever whatever | collect index=foo

This search ports the data into the foo index. The sourcetype is changed to stash.

You can specify a sourcetype with the collect command. However, specifying a sourcetype counts against your license, as if you indexed the data again.

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

True. That section is actually describing "copying" the events to another place. It would require an additional step to delete them from the prior index.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

The collect command write the search results to an index, often called as summary index based on type query result people write using collect command. It doesn't affect any of the source index(ex).

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...