Why is 'collect' not adding to a summary index on a search head cluster?

[splunkto]

I have a query where at the end I specify "| collect index=foo sourcetype=bar" and the results go into that index on a standalone search head. When I do the same on the cluster, it does not go to the index. Additionally the search head complains that it received an event for an unconfigured/disabled/deleted index=foo like it is attempting to write the data locally.

What do I need to do to the search head cluster so it targets the indexers when writing summary indexes instead of locally?

[lguinn2 · Accepted solution]

On a search head cluster, summary data must be forwarder to the indexer tier. This is a best practice for all search heads, but required for clustered search heads.

Here is a link to the documentation - Best practice: Forward search head data to the indexer layer

Create the summary index on each indexer, and follow the documentation directions to make each search head forward to the indexer tier.

[splunkto]

I just found this right before you posted.

The following is what I was missing on the cluster:
[indexAndForward]
index = false

After that it seems to add to the summary index properly now.