hi team,
I wanted to create summary index using the following query.
Daily Request counts Last Month
index=service_audit REQUEST
| bucket span=d _time
| eval time_diff=round(((stopDate - startDate)/3600000),0)
| stats count as Request_Count by _time
1.I followed all the steps mentioned in the splunk.com
2.i have created new summary index as name service_audit_summary
3.using collect command
index=service_audit REQUEST
| bucket span=d _time
| eval time_diff=round(((stopDate - startDate)/3600000),0)
| stats count as Request_Count by _time
| collect index=service_audit_summary
but the summary index not showing any event ?
4.even created report and tried but same problem I'm facing
please anyone could suggest
Thanks in advance
@prasireddy Sorry was on vacation the last two weeks. Are you still facing the issue?
Please execute your original search without testmode=true and after the execution please click on Job --> Inspect Job.
Check if you see any error message in the popup.
Please set testmode=true in your collect command and please post the outcome.
Okay, looks good. Could you please search in the summary index over all time? And please ensure you have access to the summary index.
Hi @PaulPanther Still same I'm Facing Issue
How can check weather I have access to the summary index. could you please help me.