topic Re: Why collect command not working when the command is makeresults in Search Head? in Splunk Search

Why collect command not working when the command is makeresults in search head?

splunker-2021 — Thu, 11 May 2023 10:55:44 GMT

When I run | makeresults command then collect it to summary index there is no result. I am testing this to Search Head in Cluster environment.

sample code:

| makeresults
| eval a = "1"
| collect index = "sample_index"

Re: Why collect command not working when the command is makeresults in Search Head?

VatsalJagani — Tue, 09 May 2023 16:49:13 GMT

@splunker-2021 - You query should work, considering below:

You have the index "sample_index" created
- on Indexer given you are forwarding the search head data to Indexers
- on Search Head given you are not forwarding the search head data to Indexers

Try searching the new event with below search to see if you are getting the results or not:

index=sample_index

I hope this helps!! Kindly upvote if it does!!!

Re: Why collect command not working when the command is makeresults in Search Head?

splunker-2021 — Wed, 10 May 2023 06:22:11 GMT

Hi, I have search it using index="sample_index" but no result 😞

Re: Why collect command not working when the command is makeresults in Search Head?

VatsalJagani — Wed, 10 May 2023 09:10:49 GMT

@splunker-2021 - Are you getting any error/warning messages when you run the collect command?

Re: Why collect command not working when the command is makeresults in Search Head?

splunker-2021 — Wed, 10 May 2023 12:09:17 GMT

when we try this command, index="test_1" | collect index="sample_index" it is working, but when trying the command | makeresults or | inputlookup command, it is not collecting to the index

Re: Why collect command not working when the command is makeresults in Search Head?

splunker-2021 — Wed, 10 May 2023 12:10:34 GMT

there is no error message, we just search the index="sample_index" if there is data but it is showing no result.

Re: Why collect command not working when the command is makeresults in Search Head?

VatsalJagani — Wed, 10 May 2023 13:55:44 GMT

@splunker-2021 - That should not be the case as I have used collect command with makeresults command many times before and it works fine. Not sure what's wrong in your case.

Re: Why collect command not working when the command is makeresults in Search Head?

TrangCIC81 — Thu, 11 May 2023 04:52:57 GMT

When you run the makeresults command, it generates synthetic events with a timestamp of the current time by default. However, when you collect these events to a summary index, they may not be immediately visible in the summary index search results because there may be a delay before they are indexed and available for search.
If your summary index is configured correctly and the data is being collected to it, but you still cannot see the results of your makeresults search, you may need to wait a little longer for the events to be indexed before they become available in the summary index search results.

Re: Why collect command not working when the command is makeresults in Search Head?

splunker-2021 — Thu, 11 May 2023 10:57:59 GMT

we have waited for 3 days but still no result 😞