Knowledge Management

The summary index exists, but why is the collect command not populating it with any data?

New Member

Hello Team,

I am using the search below:

index="existing_index" |fields field1,field2| collect index="new_index"

I already verified that index is present. The search above shows a result when I run it on the search head, but when I use:

index="new_index"

to find a record in new_index, then data is not available. Please suggest the solution.

0 Karma

Communicator

Does Splunk know that "new_index" is a summary index?

Create a saved search with that search and enable summary indexing

collect
Description
Adds the results of a search to a summary index that you specify. You must create the summary index before you invoke the collect command.

0 Karma

Legend

Which user is actually running the search? Does that user have permission to see this index? Check the role.

0 Karma

New Member

I am working on it from admin user and command was running properly from same user till last week. don't know what is wrong now.

0 Karma