topic Re: saved search with collect command not running/not collecting data in Reporting

saved search with collect command not running/not collecting data

kochera — Mon, 30 Nov 2015 09:36:27 GMT

Hi,

I've a scheduled saved search running every day to collect events and writting the events to a new index. Running the search interactively is working fine but running the job started by the scheduler is not working at all. No data is written to the new index. Find below the search:

index=access sourcetype="legacy"  [search (index=access sourcetype="tap") OR (index=access sourcetype=vdi) |fields + user ] |collect index=access sourcetype=legacy_spec

Any ideas what might cause this behaviour?

cheers,
Andy

Re: saved search with collect command not running/not collecting data

mzorzi — Mon, 30 Nov 2015 10:01:07 GMT

the output of collect command must be a separate summary index, it can not be the same index :

http://docs.splunk.com/Documentation/Splunk/6.3.1/SearchReference/Collect

Re: saved search with collect command not running/not collecting data

kochera — Mon, 30 Nov 2015 10:38:50 GMT

Hi,
thanks for your answer. But why is it writting the data properly when running it manually?

cheers,
Andy

Re: saved search with collect command not running/not collecting data

woodcock — Tue, 01 Dec 2015 14:08:04 GMT

I would open a support case and ask that exact question.