collect command wouldn't save to an index

[sintjm]

i have a search in my query where i spool data from an API but then the collect command does not allow me to save the search into my index. Any ideas?

[gcusello]

Hi @sintjm,

I suppose that you created the index and it has the correct grants.

did you explicit the index name in the search?

<your_search>
| table ............
| collect index=your_index

Ciao.

Giuseppe

[sintjm]

yes please, I did as such

[ITWhisperer]

You appear to be doing spath on data, then only keeping data which makes the spath redundant! What timestamps are in the events returned by the curl command?

[sintjm]

Because i don't see the events in from searching the index I created, I can't tell the timestamp. I added 

| eval _time=now()

to the query so that it would put the recent time when the endpoint was reached

[ITWhisperer]

Another possibility is to try

| table data

instead of fields

[ITWhisperer]

So, with the spath removed and the _time field added, do you events now show up in the index (after the collect command)? If not, what does the search log say for the search with the collect command?

[sintjm]

I tried using

| table data

but there is still no data when searching the index.

 With the spath removed and the _time field added there are still no events in the index and the search log can be seen below. There is still data coming through the search.

[PickleRick]

This is not the search log. You get a search log when you click the "Job" button and pick "Inspect Job". On top of the screen you'll have a link to search log.

[sintjm]

  The search log

[PickleRick]

There's no point doing spath if in the next step you leave only the original data field. But that's beside the point.

First step in debugging this would be to remove the collect command from your pipeline and see what the results look like.

[sintjm]

so there is a field in the log named data and that's where i need my log from. I also removed spath command from the query. Removing the collect command still shows the log curled from the endpoint.

[ITWhisperer]

"does not allow" is a bit vague - what errors do you get? what shows up in the log? what other information do you have?

[sintjm]

There was no logs showing after i searched the index, sorry

[ITWhisperer]

What about the logs after the collect?

[sintjm]