I am using the search below:
index="existing_index" |fields field1,field2| collect index="new_index"
I already verified that index is present. The search above shows a result when I run it on the search head, but when I use:
to find a record in new_index, then data is not available. Please suggest the solution.
Does Splunk know that "new_index" is a summary index?
Create a saved search with that search and enable summary indexing
Adds the results of a search to a summary index that you specify. You must create the summary index before you invoke the collect command.