Splunk Search

using the collect command with file option

imosquera
Explorer

I have a search command that looks like:

| mysqlquery spec="users" query="select * from users" | collect index="new_users_idx" file="new_users_$timestamp$"

But when I use the file option it never goes into "new_user_idx" index. It always goes into the "main" index. I'm currently using Splunk 4.3

Am I doing something wrong?

Tags (2)

MarioM
Motivator

i have tested and it seems that you need to add .stash_new or .stash then it goes to the right index:

| mysqlquery spec="users" query="select * from users" | collect index="new_users_idx" file="new_users_$timestamp$.stash"
0 Karma
Get Updates on the Splunk Community!

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...

Splunk Up Your Game: Why It's Time to Embrace Python 3.9+ and OpenSSL 3.0

Did you know that for Splunk Enterprise 9.4, Python 3.9 is the default interpreter? This shift is not just a ...