topic Re: Using collect for summary indexing not working in Knowledge Management

Using collect for summary indexing not working

jambajuice — Fri, 04 Feb 2011 12:56:33 GMT

I have a search that produces a table. I am piping that search to: | collect index=vulnerabilities

When the search runs, I see a status message like: Successfully wrote file to '299100603_events.stash'.

When I search on: index=vulnerabilities, no results show up. How do I troubleshoot this?

Thanks.

Craig

Re: Using collect for summary indexing not working

jambajuice — Fri, 04 Feb 2011 13:05:08 GMT

I reinstalled Splunk and chose the "Repair" option and it's working now.

Re: Using collect for summary indexing not working

Ron_Naken — Fri, 04 Feb 2011 13:11:08 GMT

If you search index=_internal, you should be able to locate references to the stash file. Once the file is indexed, you should see a message of sourcetype=splunkd that has this text in it:

INFO Metrics - group=per_source_thruput, series="$SPLUNK_HOME/var/spool/splunk/99100603_events.stash" kbps=0.067, eps=0.78, kb=1.0

Any errors should also turn up.