Hi,
I've a scheduled saved search running every day to collect events and writting the events to a new index. Running the search interactively is working fine but running the job started by the scheduler is not working at all. No data is written to the new index. Find below the search:
index=access sourcetype="legacy" [search (index=access sourcetype="tap") OR (index=access sourcetype=vdi) |fields + user ] |collect index=access sourcetype=legacy_spec
Any ideas what might cause this behaviour?
cheers,
Andy
the output of collect command must be a separate summary index, it can not be the same index :
http://docs.splunk.com/Documentation/Splunk/6.3.1/SearchReference/Collect
the output of collect command must be a separate summary index, it can not be the same index :
http://docs.splunk.com/Documentation/Splunk/6.3.1/SearchReference/Collect
Hi,
thanks for your answer. But why is it writting the data properly when running it manually?
cheers,
Andy
I would open a support case and ask that exact question.