I have this convoluted dbquery for sccm and I've boiled it down to a time and a value in a table.
The end of the search:
| table Time Total |collect index=sccmsummary sourcetype=sccm:patch marker=total_sccm_patches_needed
Time 06/13/2016 06:54:52
I want to collect this very simple info into a summary index (sccmsummary) however it is not writing to it.
So my troubleshooting has been to remove the sourcetype kv (but I have used it with collect in other successful searches). I then tried to send the results to main, which worked:
06/13/2016 06:54:52 -0700, info_search_time=1465826092.241, Time="06/13/2016 06:54:52", Total=8725, total_sccm_patches_needed
host = searchent01 source = /opt/splunk/var/spool/splunk/5f92461c476135d2_events.stash_new sourcetype = stash
Why is this not working with sccmsummary? Does anyone have any thoughts? I searched through the logs but nothing useful.
Have you created the sccmsummary index prior to running the command? You'll need to make sure the index is in place.
Also for your marker command, usually the format of that is key/value. So you might have something like
| table Time Total |collect index=sccmsummary sourcetype=sccm:patch marker="total_sccm_patches_needed=true"
yeah, the index has been created and pushed out to the indexers and search head.