Splunk Search

using the collect command with file option

imosquera
Explorer

I have a search command that looks like:

| mysqlquery spec="users" query="select * from users" | collect index="new_users_idx" file="new_users_$timestamp$"

But when I use the file option it never goes into "new_user_idx" index. It always goes into the "main" index. I'm currently using Splunk 4.3

Am I doing something wrong?

Tags (2)

MarioM
Motivator

i have tested and it seems that you need to add .stash_new or .stash then it goes to the right index:

| mysqlquery spec="users" query="select * from users" | collect index="new_users_idx" file="new_users_$timestamp$.stash"
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...