Collect Results Not Getting Indexed

[cramasta]

Hi,
I have been populating my SI using the collect command and have been finding many gaps once i come back and check out the data after a 24 hour period. If i run the backfill command all the gaps get corrected.

Last night I setup my Saved Search SI jobs that use the collect command to email me the results that should be getting put into the SI and I do have emails with data from the times from where I am seeing gaps.

Anyone know what this happens? Is using the collect command recommended? I would understand if the search was getting skipped but I have the emails showing me the search ran and produced results.

I am on 4.3.5
Thanks

[cramasta · Accepted solution]

This is happening due to bug (SPL-59578) that was fixed in 4.3.6 and 5.0.3

The simultaneous running of many summary indexing searches that use the 'stash_new' command can result in namespace collision, which can cause errors in splunkd.log similar to "WARN FileClassifierManager - The file '/var/fflanda/splunk/var/spool/splunk/RMD5257b69c72240c88d_342014304.stash_new' is invalid. Reason: binary" and block summary indexing searches from running. To work around this issue, turn off binary checking by editing $SPLUNK_HOME/etc/local/props.conf and setting the value of NO_BINARY_CHECK=1 under the [stash_new] stanza. (SPL-59578)