i've been running around in circles for a few hours now, cant figure this out.
I have a dev and prod environment (prod 4.2.5 and dev 4.3)
In dev environment i can run a search and use collect to write the events to the summary index
splunk_server=a |top host | collect index=summary
using the stash file name that is shown i can locate the data with this command
index=_internal 254301636_events.stash_new
i try the same thing in prod(4.2.5) and I am not able to find the data in the summary index. No errors as far as i can see relating to the index or command. No data anywhere.
Is there a difference in the collect command between 4.2.5 and 4.3?
What other troubleshooting can be done to help figure this out?
Once indexed in the index=summary, you should search for it using
index=summary
If you wanted to name your results, look at the option marker
http://docs.splunk.com/Documentation/Splunk/4.3.1/SearchReference/Collect
Once indexed in the index=summary, you should search for it using
index=summary
If you wanted to name your results, look at the option marker
http://docs.splunk.com/Documentation/Splunk/4.3.1/SearchReference/Collect