Knowledge Management

collect and summary index problem

EricPartington
Communicator

i've been running around in circles for a few hours now, cant figure this out.

I have a dev and prod environment (prod 4.2.5 and dev 4.3)

In dev environment i can run a search and use collect to write the events to the summary index

splunk_server=a |top host | collect index=summary

using the stash file name that is shown i can locate the data with this command

index=_internal 254301636_events.stash_new

i try the same thing in prod(4.2.5) and I am not able to find the data in the summary index. No errors as far as i can see relating to the index or command. No data anywhere.

Is there a difference in the collect command between 4.2.5 and 4.3?

What other troubleshooting can be done to help figure this out?

0 Karma
1 Solution

yannK
Splunk Employee
Splunk Employee

Once indexed in the index=summary, you should search for it using

index=summary

If you wanted to name your results, look at the option marker
http://docs.splunk.com/Documentation/Splunk/4.3.1/SearchReference/Collect

View solution in original post

yannK
Splunk Employee
Splunk Employee

Once indexed in the index=summary, you should search for it using

index=summary

If you wanted to name your results, look at the option marker
http://docs.splunk.com/Documentation/Splunk/4.3.1/SearchReference/Collect

Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...