Why is collect command not writing correct results to summary index?

[Splunk4]

Hi Everyone,

I am using the collect command to write data in summary index and it is giving the values properly when i run the search manually before using collect command but when i put the collect command the values become 0.

Attached are the screenshots before collect and the job results of saved search

If anyone has idea on this pls let me know.

Thanks

[Splunk4]

Sorry i am unbale to post screenshot but here is the search :

index=iam_myid_transac_idx sourcetype="myid_identity" employeeno=* ((employeesource=* employeesubgrp="Contractor") OR (employeesource=* employeesubgrp="Vendors") OR (employeesource=* employeesubgrp="Consultant") OR (employeesource=* employeesubgrp="Agency Temp") OR (employeesource="Temporary Identity" employeesubgrp!="Consultant")) status="Active" earliest=@d latest=now()
|fields employeeno,employeesource,employeesubgrp,employmentenddate
|dedup employeeno
|fillnull value=NULL employmentenddate
|stats count(eval(in(employmentenddate,"31/12/9999","NULL"))) as Contractors_with_no_enddate count(employeeno) as Total_Contractors
|eval Metric9=floor((Contractors_with_no_enddate/Total_Contractors)*100*100)/100
|eval _time=now()
|collect index="iam_reporting_summary_idx" source="myid" marker="Control=\"User De-provisioning\""

Below are the results if i remove the collect and runa manually :

Contractors_with_no_enddate Total_Contractors Metric9 _time

8353

8535

97.86

2022-11-19 23:56:1

Below are results coming when i view the results in job inspector and check in index.

Contractors_with_no_enddate Total_Contractors _time

0

0

2022-11-19 10:07:0

[ITWhisperer]

What is the search you are using to get the results from the summary index?

[gcusello]

Hi @Splunk4,

did you tried with a simpler collect command e.g. using only index option or a marker without quotes?

marker="User De-provisioning"

Obviously you already created the index befre executing the search.

Ciao.

Giuseppe

[Splunk4]

This search was working fine earlier and results were coming properly.What i have noticed that the other this search running from one of the search head and due to which it might not be working while the other searches run from another search head and they are working fine.I am not sure how to check on this thing.

Thanks