https://community.splunk.com/t5/Splunk-Search/Why-is-my-search-using-quot-mcollect-quot-command-causing-the/m-p/456073#M128949 <P>I feel that the output of the results may not be right since the method is different.</P> <PRE><CODE>| table _time, value, a_dimension, metric_name | mcollect index=test_metric </CODE></PRE> <P><STRONG>_time value a_dimension metric_name</STRONG><BR /> 2018-09-12 12:16:01.100 1.45 view_point view.point.metrics<BR /> 2018-09-12 12:19:01.100 0.9 view_point view.point.metrics<BR /> 2018-09-12 12:21:01.100 3.41 view_point view.point.metrics</P> <P>Field value is a double. If I try to rename value to _value, still does not work.</P> Tue, 29 Sep 2020 21:14:52 GMT ben_leung 2020-09-29T21:14:52Z https://community.splunk.com/t5/Splunk-Search/Why-is-my-search-using-quot-mcollect-quot-command-causing-the/m-p/456070#M128946 <P>In my query before, I was using the <CODE>outputcsv</CODE> search command, and then I had a monitoring input stanza to upload it to my metrics index.</P> <P>I then took out the <CODE>outputcsv</CODE> command and started using <CODE>mcollect</CODE>.</P> <P>Not sure why, but the metrics index is not valid when it recieved metrics from a different method.</P> <PRE><CODE>.... | mcollect index=metrics-index </CODE></PRE> <P>And on my indexes.conf, the settings is configured to be metrics:</P> <PRE><CODE>[metrics-index] datatype = metric </CODE></PRE> <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/5757i89FAF3E75312F025/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> Tue, 11 Sep 2018 22:38:13 GMT https://community.splunk.com/t5/Splunk-Search/Why-is-my-search-using-quot-mcollect-quot-command-causing-the/m-p/456070#M128946 ben_leung 2018-09-11T22:38:13Z https://community.splunk.com/t5/Splunk-Search/Why-is-my-search-using-quot-mcollect-quot-command-causing-the/m-p/456071#M128947 <P>This is a distributed search environment with search head clustering.</P> Wed, 12 Sep 2018 01:23:25 GMT https://community.splunk.com/t5/Splunk-Search/Why-is-my-search-using-quot-mcollect-quot-command-causing-the/m-p/456071#M128947 ben_leung 2018-09-12T01:23:25Z https://community.splunk.com/t5/Splunk-Search/Why-is-my-search-using-quot-mcollect-quot-command-causing-the/m-p/456072#M128948 <P>So, here's some triage steps.</P> <HR /> <P>1) Put quotes around your metrics index name and submit again. If that fixes the problem, then the hyphen is being incorrectly interpreted as a minus sign. Skip the remainder of the steps. </P> <HR /> <P>2A) Create a new, empty metrics index "junkmetrics" with no special characters in the name.</P> <P>2B) Try your query with <CODE>mcollect</CODE> with that new index. </P> <P>If that works, then the problem is either the name with the hyphens, or the prior data in the index. </P> <P>2C) Create a junk index with hyphens in the name and try again. (It's supposed to be allowed as an index name, but none of the examples have hyphens.)</P> <P>If that works, then the prior data is the likely culprit.</P> <HR /> <P>3) If that (2A) does not work, then those two items are off the table, and you know it is probably something with your search language itself. You've already tested the index name, so just report back and let us know, and we'll give you the next tranche of guesses.</P> Wed, 12 Sep 2018 04:05:00 GMT https://community.splunk.com/t5/Splunk-Search/Why-is-my-search-using-quot-mcollect-quot-command-causing-the/m-p/456072#M128948 DalJeanis 2018-09-12T04:05:00Z https://community.splunk.com/t5/Splunk-Search/Why-is-my-search-using-quot-mcollect-quot-command-causing-the/m-p/456073#M128949 <P>I feel that the output of the results may not be right since the method is different.</P> <PRE><CODE>| table _time, value, a_dimension, metric_name | mcollect index=test_metric </CODE></PRE> <P><STRONG>_time value a_dimension metric_name</STRONG><BR /> 2018-09-12 12:16:01.100 1.45 view_point view.point.metrics<BR /> 2018-09-12 12:19:01.100 0.9 view_point view.point.metrics<BR /> 2018-09-12 12:21:01.100 3.41 view_point view.point.metrics</P> <P>Field value is a double. If I try to rename value to _value, still does not work.</P> Tue, 29 Sep 2020 21:14:52 GMT https://community.splunk.com/t5/Splunk-Search/Why-is-my-search-using-quot-mcollect-quot-command-causing-the/m-p/456073#M128949 ben_leung 2020-09-29T21:14:52Z https://community.splunk.com/t5/Splunk-Search/Why-is-my-search-using-quot-mcollect-quot-command-causing-the/m-p/456074#M128950 <P>Okay so to resolve the issue, setup the metrics index on the search head cluster.<BR /> Missing the indexes.conf on our search head cluster. Overlooked this because we have indexes defined on our indexers.<BR /> Also because the previous method of using outputcsv and a monitoring stanza did not require any index definition on search heads.</P> Thu, 20 Sep 2018 06:36:45 GMT https://community.splunk.com/t5/Splunk-Search/Why-is-my-search-using-quot-mcollect-quot-command-causing-the/m-p/456074#M128950 ben_leung 2018-09-20T06:36:45Z https://community.splunk.com/t5/Splunk-Search/Why-is-my-search-using-quot-mcollect-quot-command-causing-the/m-p/456075#M128951 <P>In a distributed splunk environment, the search head also needs to have stub index of the same name and datatype for any of the collect (ie. collect, mcollect, meventcollect). Note: for metric index, you will need to specify datatype = metric in the relevant index.conf stanza. </P> Thu, 20 Sep 2018 16:48:04 GMT https://community.splunk.com/t5/Splunk-Search/Why-is-my-search-using-quot-mcollect-quot-command-causing-the/m-p/456075#M128951 splunkIT 2018-09-20T16:48:04Z https://community.splunk.com/t5/Splunk-Search/Why-is-my-search-using-quot-mcollect-quot-command-causing-the/m-p/456076#M128952 <P>Right, just couldn't find a doc for version 7.1.2 about that.</P> Fri, 21 Sep 2018 10:17:21 GMT https://community.splunk.com/t5/Splunk-Search/Why-is-my-search-using-quot-mcollect-quot-command-causing-the/m-p/456076#M128952 ben_leung 2018-09-21T10:17:21Z https://community.splunk.com/t5/Splunk-Search/Why-is-my-search-using-quot-mcollect-quot-command-causing-the/m-p/456077#M128953 <P>index=xyz source=abc |table coloumnone coloumtwo |mcollect index=metric_index split=true coloumtwo </P> <P>above is the example hope it helps </P> Wed, 27 Nov 2019 12:53:38 GMT https://community.splunk.com/t5/Splunk-Search/Why-is-my-search-using-quot-mcollect-quot-command-causing-the/m-p/456077#M128953 anem 2019-11-27T12:53:38Z