Splunk Enterprise

why indexed fields are not creating when i collect data to summary index



I have created indexed fields at the time of indexing, then i executed the tstats query, and it's working fine.

But when i collect resulted data into summary index using splunk collect command, my tstats is not working on summary index.

| tstats latest(result._time) as _time ,values(result.relational_correlationId) as relational_correlationId,values(result.tracePoint) as tracePoint where index="hec_example1" by result.environment,result.businessGroup,result.appName,result.interfaceName,result.correlationId | table _time,tracePoint | collect index="summary_mt"


tstats is not working on summary index(I have configured fields.conf as well)

Labels (1)
0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!