Implementing Splunk 7, Third Edition - Third Edition

Using collect to produce custom summary indexes

If the number of events destined for your summary index could be represented in a single report, we can use the collect function to create our own summary index entries directly. This has the advantage that we can build our index in one shot. That could be much faster than running the backfill script, which must run one search per slice of time. For instance, if you want to calculate 15-minute slices over a month, the script will fire off 2,880 queries.

If you dig into the code that actually produces summary indexes, you will find that it uses the collect command to store events into the specified index. The collect command is available to us, and with a little knowledge, we can use it directly. ...