Hi everybody,
is it possible to create several summary index within one search?
Example:
"**Index A**" has a **field** "**OS**" with **values** "**Windows**", "**Linux**"...
Is there a way to tell splunk to loop something like: `index=A | collect index="OS"` (where OS is the field-value)
So that each result based on field OS will be stored in (allready created) index "Windows", "Linux", ....
Many thanks in advance.
↧