Splunk Enterprise

is there a way to check if makeresults stored the events in index or not ?

jayjoshi64
Engager

I am searching like this in Splunk:

  | makeresults count=3 | eval _raw="demo event" | collect index=main sourcetype="sample"

It generates the events and also stores these 3 events in the index.

and then I searched this:

| makeresults count=3 | eval _raw="demo event" | collect index="randomindex" sourcetype="sample"

Here, "randomIndex" is not available in the Splunk instance, so it will not store the events, but it will show all 3 events anyway when the above search is fired. but still not stored anywhere.

I am trying same to do using REST API to search "makeresults" multiple times and store in the given index but there is no way to check whether the events has been stored successfully or not.

Is there a way to check whether the makeresults stored the event successfully or not.? using job properties or anything.?

Tags (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi
you have to create Index before use collect command (see https://docs.splunk.com/Documentation/Splunk/7.0.1/SearchReference/Collect ) so you're sure to find events in that index.

Bye.
Giuseppe

jayjoshi64
Engager

I have checked whether index is available in the Splunk Instance by checking if index's stanza is available in indexes.conf or not.

if there is error message in the response. create the Index by adding the stanza in the indexes.conf

to check and add stanza: check stanza by REST API

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...