saved search with collect command not running/not collecting data

[kochera]

Hi,

I've a scheduled saved search running every day to collect events and writting the events to a new index. Running the search interactively is working fine but running the job started by the scheduler is not working at all. No data is written to the new index. Find below the search:

index=access sourcetype="legacy"  [search (index=access sourcetype="tap") OR (index=access sourcetype=vdi) |fields + user ] |collect index=access sourcetype=legacy_spec

Any ideas what might cause this behaviour?

cheers,
Andy

[mzorzi · Accepted solution]

the output of collect command must be a separate summary index, it can not be the same index :

http://docs.splunk.com/Documentation/Splunk/6.3.1/SearchReference/Collect

[kochera]

Hi,
thanks for your answer. But why is it writting the data properly when running it manually?

cheers,
Andy

[woodcock]

I would open a support case and ask that exact question.