Why collect command not working when the command is makeresults in search head?

[splunker-2021]

When I run | makeresults command then collect it to summary index there is no result. I am testing this to Search Head in Cluster environment.

sample code:

| makeresults
| eval a = "1"
| collect index = "sample_index"

[TrangCIC81]

When you run the makeresults command, it generates synthetic events with a timestamp of the current time by default. However, when you collect these events to a summary index, they may not be immediately visible in the summary index search results because there may be a delay before they are indexed and available for search.
If your summary index is configured correctly and the data is being collected to it, but you still cannot see the results of your makeresults search, you may need to wait a little longer for the events to be indexed before they become available in the summary index search results.

[splunker-2021]

we have waited for 3 days but still no result 😞

[splunker-2021]

Hi, I have search it using index="sample_index" but no result 😞

[VatsalJagani]

@splunker-2021 - Are you getting any error/warning messages when you run the collect command?

[splunker-2021]

there is no error message, we just search the index="sample_index" if there is data but it is showing no result.

[splunker-2021]

when we try this command, index="test_1" | collect index="sample_index" it is working, but when trying the command | makeresults or | inputlookup command, it is not collecting to the index

[VatsalJagani]

@splunker-2021 - That should not be the case as I have used collect command with makeresults command many times before and it works fine. Not sure what's wrong in your case.

[VatsalJagani]

@splunker-2021 - You query should work, considering below:

• You have the index "sample_index" created
  • on Indexer given you are forwarding the search head data to Indexers
  • on Search Head given you are not forwarding the search head data to Indexers

Try searching the new event with below search to see if you are getting the results or not:

index=sample_index

I hope this helps!! Kindly upvote if it does!!!