Issue with writing to an index

[ccsfdave]

I have this convoluted dbquery for sccm and I've boiled it down to a time and a value in a table.

The end of the search:

| table Time Total |collect index=sccmsummary sourcetype=sccm:patch marker=total_sccm_patches_needed 

The results:

Time 06/13/2016 06:54:52    
Total 8725

I want to collect this very simple info into a summary index (sccmsummary) however it is not writing to it.

So my troubleshooting has been to remove the sourcetype kv (but I have used it with collect in other successful searches). I then tried to send the results to main, which worked:

6/13/16
6:54:52.000 AM  
06/13/2016 06:54:52 -0700, info_search_time=1465826092.241, Time="06/13/2016 06:54:52", Total=8725, total_sccm_patches_needed
host = searchent01 source = /opt/splunk/var/spool/splunk/5f92461c476135d2_events.stash_new sourcetype = stash

Why is this not working with sccmsummary? Does anyone have any thoughts? I searched through the logs but nothing useful.

Thanks!

[ryanoconnor]

Have you created the sccmsummary index prior to running the command? You'll need to make sure the index is in place.

Also for your marker command, usually the format of that is key/value. So you might have something like

| table Time Total |collect index=sccmsummary sourcetype=sccm:patch marker="total_sccm_patches_needed=true"

[ccsfdave]

@ryanoconnor

yeah, the index has been created and pushed out to the indexers and search head.