Knowledge Management

Why can't user save to summary index?

a212830
Champion

Hi,

I have a power user who wants to save the results to a summary index, using sistats. The index exists on each indexer and on the search-head, but when he tries to save it, an error message appears:

"Encountered the following error while trying to save: In handler 'savedsearch': Index name=eup_aternity_summary does not exist. The summary index must exist in order for a scheduled search to populate it."

When I edit the search and save it to use this summary index, it works. Is there a permissions issue for indexes?

0 Karma

jeremiahc4
Builder

I'm curious on this one. I've never been able to index anything into splunk aside from via the admin user. I've even created a role (back in 4.2.2) and granted it every permission available and still not been able to upload anything that way. I'd think summarizing into an index would follow suit as it's uploading data to the index.

0 Karma

yannK
Splunk Employee
Splunk Employee

make sure that the index definition "exists" on the search-head.

and that the user has a role with the capability to "schedule search"

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Check if the role assigned to the user have access to that index. Go to Settings-> User Access-> Roles -> That Particular Role -> Indexes (last section) and see if the index eup_aternity_summary is listed there.

0 Karma

a212830
Champion

Does it need to be specifically allowed acccess?

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Yes, A user or all user in that role will only have access to Indexers defined by Settings-> User Access-> Roles -> That Particular Role -> Indexes.

If you want a universal access, you can select options "All non-internal indexes" to access to all indexes (non splunk's internal)

0 Karma

a212830
Champion

Thanks. Just checked the role - it has "All non-internal indexes". Do they need some write permissions for summary indexes?

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Also ensure that the role for your user have "schedule_search" capabilities.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...