I have a search command that looks like:
| mysqlquery spec="users" query="select * from users" | collect index="new_users_idx" file="new_users_$timestamp$"
But when I use the file option it never goes into "new_user_idx" index. It always goes into the "main" index. I'm currently using Splunk 4.3
Am I doing something wrong?
i have tested and it seems that you need to add .stash_new
or .stash
then it goes to the right index:
| mysqlquery spec="users" query="select * from users" | collect index="new_users_idx" file="new_users_$timestamp$.stash"