https://community.splunk.com/t5/Splunk-Search/Metric-mcollect-command-error/m-p/457677#M170457 <P>I figured in out. we are in a distributed environment and this index needed to be on the search head as well as indexers (of course).</P> Mon, 08 Jul 2019 21:28:19 GMT brdr 2019-07-08T21:28:19Z https://community.splunk.com/t5/Splunk-Search/Metric-mcollect-command-error/m-p/457676#M170456 <P>Hello, </P> <P>I've been using this command on other metric indexes and i can't get this one to work. </P> <P>index=iiot_index Tag="simple_tag" AND metric_name="simple_metric" Quality=good <BR /> | eval Value=CASE(<BR /> Value="TRUE", 1,<BR /> Value="FALSE", 0,<BR /> Value="ACTIVE", 1,<BR /> Value="IN_PROGRESS", 1,<BR /> Value="ARMED", 1,<BR /> Value="TRIGGERED", 0,<BR /> Value="ON", 1,<BR /> Value="OFF", 0,<BR /> 1=1, Value) <BR /> | rex field=asset_name "(?.<EM>).(?.</EM>)" <BR /> | eval _value=Value <BR /> | where isnum(_value)<BR /> | table asset metric_name Value _time <BR /> | mcollect index=iiot_index_metric asset,metric_name,Value</P> <P>The error i get is this:</P> <P>Error in 'mcollect' command: Must specify a valid metric index.</P> <P>I do get data from the first index above, and this index in the last line is a metrics index.</P> <P>Thanks</P> Wed, 30 Sep 2020 01:11:53 GMT https://community.splunk.com/t5/Splunk-Search/Metric-mcollect-command-error/m-p/457676#M170456 brdr 2020-09-30T01:11:53Z https://community.splunk.com/t5/Splunk-Search/Metric-mcollect-command-error/m-p/457677#M170457 <P>I figured in out. we are in a distributed environment and this index needed to be on the search head as well as indexers (of course).</P> Mon, 08 Jul 2019 21:28:19 GMT https://community.splunk.com/t5/Splunk-Search/Metric-mcollect-command-error/m-p/457677#M170457 brdr 2019-07-08T21:28:19Z