Hello Team,
I am using the search below:
index="existing_index" |fields field1,field2| collect index="new_index"
I already verified that index is present. The search above shows a result when I run it on the search head, but when I use:
index="new_index"
to find a record in new_index, then data is not available. Please suggest the solution.
Does Splunk know that "new_index" is a summary index?
Create a saved search with that search and enable summary indexing
collect
Description
Adds the results of a search to a summary index that you specify. You must create the summary index before you invoke the collect command.
Which user is actually running the search? Does that user have permission to see this index? Check the role.
I am working on it from admin user and command was running properly from same user till last week. don't know what is wrong now.