Splunk Enterprise

why indexed fields are not creating when i collect data to summary index

nagendraDumpala
Engager

Hello,

I have created indexed fields at the time of indexing, then i executed the tstats query, and it's working fine.

But when i collect resulted data into summary index using splunk collect command, my tstats is not working on summary index.

| tstats latest(result._time) as _time ,values(result.relational_correlationId) as relational_correlationId,values(result.tracePoint) as tracePoint where index="hec_example1" by result.environment,result.businessGroup,result.appName,result.interfaceName,result.correlationId | table _time,tracePoint | collect index="summary_mt"

 

tstats is not working on summary index(I have configured fields.conf as well)

Labels (1)
0 Karma
Get Updates on the Splunk Community!

Say goodbye to manually analyzing phishing and malware threats with Splunk Attack ...

In today’s evolving threat landscape, we understand you’re constantly bombarded with phishing and malware ...

AppDynamics is now part of Splunk Ideas

Hello Splunkers, We have exciting news for you! AppDynamics has been added to the Splunk Ideas Portal. Which ...

Advanced Splunk Data Management Strategies

Join us on Wednesday, May 14, 2025, at 11 AM PDT / 2 PM EDT for an exclusive Tech Talk that delves into ...