Splunk Enterprise

why indexed fields are not creating when i collect data to summary index

nagendraDumpala
Engager

Hello,

I have created indexed fields at the time of indexing, then i executed the tstats query, and it's working fine.

But when i collect resulted data into summary index using splunk collect command, my tstats is not working on summary index.

| tstats latest(result._time) as _time ,values(result.relational_correlationId) as relational_correlationId,values(result.tracePoint) as tracePoint where index="hec_example1" by result.environment,result.businessGroup,result.appName,result.interfaceName,result.correlationId | table _time,tracePoint | collect index="summary_mt"

 

tstats is not working on summary index(I have configured fields.conf as well)

Labels (1)
0 Karma
Get Updates on the Splunk Community!

Splunk Smartness with Brandon Sternfield | Episode 3

Hello and welcome to another episode of "Splunk Smartness," the interview series where we explore the power of ...

Monitoring Postgres with OpenTelemetry

Behind every business-critical application, you’ll find databases. These behind-the-scenes stores power ...

Mastering Synthetic Browser Testing: Pro Tips to Keep Your Web App Running Smoothly

To start, if you're new to synthetic monitoring, I recommend exploring this synthetic monitoring overview. In ...