Splunk Search

Why is collect command not writing correct results to summary index?

Splunk4
Explorer

Hi Everyone,

I am using the collect command to write data in summary index and it is giving the values properly when i run the search manually before using collect command but when i put the collect command the values become 0.

 
 

Attached are the screenshots before collect and the job results of saved search

If anyone has idea on this pls let me know.

 

 

Thanks

Labels (3)
Tags (2)
0 Karma

Splunk4
Explorer

Sorry i am unbale to post screenshot but here is the search :

 

index=iam_myid_transac_idx sourcetype="myid_identity" employeeno=* ((employeesource=* employeesubgrp="Contractor") OR (employeesource=* employeesubgrp="Vendors") OR (employeesource=* employeesubgrp="Consultant") OR (employeesource=* employeesubgrp="Agency Temp") OR (employeesource="Temporary Identity" employeesubgrp!="Consultant")) status="Active" earliest=@d latest=now()
|fields employeeno,employeesource,employeesubgrp,employmentenddate
|dedup employeeno
|fillnull value=NULL employmentenddate
|stats count(eval(in(employmentenddate,"31/12/9999","NULL"))) as Contractors_with_no_enddate count(employeeno) as Total_Contractors
|eval Metric9=floor((Contractors_with_no_enddate/Total_Contractors)*100*100)/100
|eval _time=now()
|collect index="iam_reporting_summary_idx" source="myid" marker="Control=\"User De-provisioning\""

 

Below are the results if i remove the collect and runa manually :

 

Contractors_with_no_enddate Total_Contractors Metric9 _time

8353853597.862022-11-19 23:56:1

 

Below are results coming when i view the results in job inspector and check in index.

 

Contractors_with_no_enddate Total_Contractors _time

002022-11-19 10:07:0
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

What is the search you are using to get the results from the summary index?

0 Karma

gcusello
Esteemed Legend

Hi @Splunk4,

did you tried with a simpler collect command e.g. using only index option or a marker without quotes?

marker="User De-provisioning"

Obviously you already created the index befre executing the search.

Ciao.

Giuseppe

0 Karma

Splunk4
Explorer

This search was working fine earlier and results were coming properly.What i have noticed that the other this search running from one of the search head and due to which it might not be working while the other searches run from another search head and they are working fine.I am not sure how to check on this thing.

 

Thanks

0 Karma
Get Updates on the Splunk Community!

Dashboard Studio Challenge - Learn New Tricks, Showcase Your Skills, and Win Prizes!

Reimagine what you can do with your dashboards. Dashboard Studio is Splunk’s newest dashboard builder to ...

Introducing Edge Processor: Next Gen Data Transformation

We get it - not only can it take a lot of time, money and resources to get data into Splunk, but it also takes ...

Take the 2021 Splunk Career Survey for $50 in Amazon Cash

Help us learn about how Splunk has impacted your career by taking the 2021 Splunk Career Survey. Last year’s ...