Not result get from collect

[Wendy1990]

I schedule below search, search name is "TransactionResult"

sourcetype="ims*" host="chi*" ActivityId!="(null)" (Action="Start" OR Action="End") | eval TopicName= mvindex(split(TopicName,"."),-1) | transaction ActivityId TopicName startswith="Start" endswith="End" maxevents=2 | fields FirmName ActivityId TopicName duration _time | collect addtime=true index=summary_abuse

After above search completed, I use

"index=summary_abuse search_name="TransactionResult" to get the result of search , but the result is empty ,why?

[masonmorales]

Best practice is to use a marker, which creates a new key/value pair in each SI result. The marker then allows you to easily retrieve the results you want from the SI.

Here's how you can add it to your search:

sourcetype="ims*" host="chi*" ActivityId!="(null)" (Action="Start" OR Action="End") | eval TopicName= mvindex(split(TopicName,"."),-1) | transaction ActivityId TopicName startswith="Start" endswith="End" maxevents=2 | fields FirmName ActivityId TopicName duration _time | collect addtime=true index=summary_abuse marker="si_search_name=TransactionResult"

Then, to retrieve the results, you just do:

index=summary_abuse si_search_name=TransactionResult

[alacercogitatus · Accepted solution]

I don't think search_name is the right field to use here.

Did you try:

index=summary_abuse source="TransactionResult"

[Wendy1990]

Transaction can calculate duration, but I don't see the field duration value for each ActivityId.

[Wendy1990]

I want to save the result of transaction command, now I can see the event with your command, but duration value is null, why?
I use this command
index=summary source="transtest" | table FirmName ActivityId TopicName duration _time