Knowledge Management

Issue with writing to an index

ccsfdave
Builder

I have this convoluted dbquery for sccm and I've boiled it down to a time and a value in a table.

The end of the search:

| table Time Total |collect index=sccmsummary sourcetype=sccm:patch marker=total_sccm_patches_needed 

The results:

Time 06/13/2016 06:54:52    
Total 8725

I want to collect this very simple info into a summary index (sccmsummary) however it is not writing to it.

So my troubleshooting has been to remove the sourcetype kv (but I have used it with collect in other successful searches). I then tried to send the results to main, which worked:

6/13/16
6:54:52.000 AM  
06/13/2016 06:54:52 -0700, info_search_time=1465826092.241, Time="06/13/2016 06:54:52", Total=8725, total_sccm_patches_needed
host = searchent01 source = /opt/splunk/var/spool/splunk/5f92461c476135d2_events.stash_new sourcetype = stash

Why is this not working with sccmsummary? Does anyone have any thoughts? I searched through the logs but nothing useful.

Thanks!

0 Karma

ryanoconnor
Builder

Have you created the sccmsummary index prior to running the command? You'll need to make sure the index is in place.

Also for your marker command, usually the format of that is key/value. So you might have something like

| table Time Total |collect index=sccmsummary sourcetype=sccm:patch marker="total_sccm_patches_needed=true"
0 Karma

ccsfdave
Builder

@ryanoconnor

yeah, the index has been created and pushed out to the indexers and search head.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...