https://community.splunk.com/t5/Knowledge-Management/collect-and-summary-index-problem/m-p/74151#M722 <P>i've been running around in circles for a few hours now, cant figure this out.</P> <P>I have a dev and prod environment (prod 4.2.5 and dev 4.3)</P> <P>In dev environment i can run a search and use collect to write the events to the summary index</P> <PRE><CODE>splunk_server=a |top host | collect index=summary </CODE></PRE> <P>using the stash file name that is shown i can locate the data with this command</P> <PRE><CODE>index=_internal 254301636_events.stash_new </CODE></PRE> <P>i try the same thing in prod(4.2.5) and I am not able to find the data in the summary index. No errors as far as i can see relating to the index or command. No data anywhere.</P> <P>Is there a difference in the collect command between 4.2.5 and 4.3?</P> <P>What other troubleshooting can be done to help figure this out?</P> Sat, 18 Feb 2012 03:36:41 GMT EricPartington 2012-02-18T03:36:41Z https://community.splunk.com/t5/Knowledge-Management/collect-and-summary-index-problem/m-p/74151#M722 <P>i've been running around in circles for a few hours now, cant figure this out.</P> <P>I have a dev and prod environment (prod 4.2.5 and dev 4.3)</P> <P>In dev environment i can run a search and use collect to write the events to the summary index</P> <PRE><CODE>splunk_server=a |top host | collect index=summary </CODE></PRE> <P>using the stash file name that is shown i can locate the data with this command</P> <PRE><CODE>index=_internal 254301636_events.stash_new </CODE></PRE> <P>i try the same thing in prod(4.2.5) and I am not able to find the data in the summary index. No errors as far as i can see relating to the index or command. No data anywhere.</P> <P>Is there a difference in the collect command between 4.2.5 and 4.3?</P> <P>What other troubleshooting can be done to help figure this out?</P> Sat, 18 Feb 2012 03:36:41 GMT https://community.splunk.com/t5/Knowledge-Management/collect-and-summary-index-problem/m-p/74151#M722 EricPartington 2012-02-18T03:36:41Z https://community.splunk.com/t5/Knowledge-Management/collect-and-summary-index-problem/m-p/74152#M723 <P>Once indexed in the index=summary, you should search for it using <BR /> <CODE><BR /> index=summary<BR /> </CODE><BR /> If you wanted to name your results, look at the option marker<BR /> <A href="http://docs.splunk.com/Documentation/Splunk/4.3.1/SearchReference/Collect">http://docs.splunk.com/Documentation/Splunk/4.3.1/SearchReference/Collect</A></P> Tue, 24 Apr 2012 01:29:43 GMT https://community.splunk.com/t5/Knowledge-Management/collect-and-summary-index-problem/m-p/74152#M723 yannK 2012-04-24T01:29:43Z