topic Re: Collect command not writing correct results to summary index in Splunk Search

Why is collect command not writing correct results to summary index?

Splunk4 — Mon, 21 Nov 2022 03:36:23 GMT

Hi Everyone,

I am using the collect command to write data in summary index and it is giving the values properly when i run the search manually before using collect command but when i put the collect command the values become 0.

Attached are the screenshots before collect and the job results of saved search

If anyone has idea on this pls let me know.

Thanks

Re: Collect command not writing correct results to summary index

Splunk4 — Sat, 19 Nov 2022 12:57:45 GMT

Sorry i am unbale to post screenshot but here is the search :

index=iam_myid_transac_idx sourcetype="myid_identity" employeeno=* ((employeesource=* employeesubgrp="Contractor") OR (employeesource=* employeesubgrp="Vendors") OR (employeesource=* employeesubgrp="Consultant") OR (employeesource=* employeesubgrp="Agency Temp") OR (employeesource="Temporary Identity" employeesubgrp!="Consultant")) status="Active" earliest=@d latest=now()
|fields employeeno,employeesource,employeesubgrp,employmentenddate
|dedup employeeno
|fillnull value=NULL employmentenddate
|stats count(eval(in(employmentenddate,"31/12/9999","NULL"))) as Contractors_with_no_enddate count(employeeno) as Total_Contractors
|eval Metric9=floor((Contractors_with_no_enddate/Total_Contractors)*100*100)/100
|eval _time=now()
|collect index="iam_reporting_summary_idx" source="myid" marker="Control=\"User De-provisioning\""

Below are the results if i remove the collect and runa manually :

Contractors_with_no_enddate Total_Contractors Metric9 _time

8353

8535

97.86

2022-11-19 23:56:1

Below are results coming when i view the results in job inspector and check in index.

Contractors_with_no_enddate Total_Contractors _time

2022-11-19 10:07:0

Re: Collect command not writing correct results to summary index

gcusello — Sun, 20 Nov 2022 06:43:04 GMT

Hi @Splunk4,

did you tried with a simpler collect command e.g. using only index option or a marker without quotes?

marker="User De-provisioning"

Obviously you already created the index befre executing the search.

Ciao.

Giuseppe

Re: Collect command not writing correct results to summary index

ITWhisperer — Sun, 20 Nov 2022 08:01:43 GMT

What is the search you are using to get the results from the summary index?

Re: Collect command not writing correct results to summary index

Splunk4 — Mon, 21 Nov 2022 03:30:41 GMT

This search was working fine earlier and results were coming properly.What i have noticed that the other this search running from one of the search head and due to which it might not be working while the other searches run from another search head and they are working fine.I am not sure how to check on this thing.

Thanks