Rest command from saved search

[reed_kelly]

I'm trying to capture index disk utilization to a summary index using a rest command. The command is something like:
|rest /services/data/indexes |table splunk_server,title,currentDBSizeMB

This produces a nice table with indexers, indexes and how much disk space each index is taking.

When I run this from a scheduled search, however, I get the following warning in the Inspect screen:
...
WARN: Unable to fetch REST endpoint '/services/data/indexes' from "

In addition, nothing shows up in the specified summary index.

Any suggestions for getting disk utilization by index saved to a summary index for trend reporting?

Search head is Splunk 4.3.1.

[MarioM · Accepted solution]

i am not sure if it is a typo but "server" doesnot exist(splunk_server is the right field) and when i do the following it works for me:

| rest /services/data/indexes | table splunk_server,title,currentDBSizeMB | sort - currentDBSizeMB | collect index=summary_rest

[MarioM]

for records i am running v5.0.1

[reed_kelly]

OK. It's working now. I have no idea why it took so long to populate. The typo was in the above question, but it was not in the query on the server. I don't have an explanation, but I'm going to accept your answer.

[reed_kelly]

Are you saying that your summary index gets populated? What version are you running?

[reed_kelly]

Update: I tried adding "|collect index=my_summary" to the end of the search and nothing was saved to the summary index. It didn't matter if I ran it interactively. I can see the results in the GUI, but nothing gets written to the summary index.