Collect Command Not working

Applicability

Description

When running a search that runs the collect command to a different index, data is not being sent correctly. No results show up when checking the receiving index.

The collect command adds the results of a search to a specific summary index. The summary index must be created before invoking the collect command.

If there are replication issues, the command might not work as expected. Link for reference: collect | Splunk Docs

Investigation

Use the following command in the CLI to check if the index exists in an instance: 

$SPLUNK_HOME/bin/splunk btool indexes list --debug | grep <index_name>

If the instance has the Web UI enabled, this can also be confirmed by going to Settings > Indexes > <index_name>

Resolution

Make sure that the specified index exists in both the Indexers and the Search Head where the collect command is being used. If no results show up in the specified index after using the command, it most likely has not been created in the Search Head.

Another way to check that the index exists in the Indexers is by logging into the Cluster Manager and going to Settings > Indexer Clustering > Indexes > <index_name>

Related Links

collect | Splunk Docs

Configure summary indexes | Splunk Docs