Splunk Search

View Summary Index query

deepak02
Path Finder

Hi,

I have been handed over a bunch of summary indexes I should be using as base.

I have full access to the Search Heads.

Is there anyway I can view the queries used by the summary indexes given their names (since the person has already left)?

Thanks,
Deepak

Note: I am using Splunk Enterprise.

Tags (1)
0 Karma
1 Solution

rphillips_splk
Splunk Employee
Splunk Employee

@deepak02 you can use the REST api endpoint for saved searches and look for those which have summary indexing enabled:

run this search:
| rest /servicesNS/-/-/saved/searches | search action.summary_index=1 | table title qualifiedSearch action.summary_index

View solution in original post

0 Karma

somesoni2
SplunkTrust
SplunkTrust

If the owner of saved search using summary index has left and his account is deleted/disabled, you might not be able to search REST API endpoint. REST API approach would be better one if it can work though. If it doesn't and if you can query filesystem on the search head, I would try following grep command to locate searches using a particular summary index.

from $Splunk_Home/etc/apps and $Splunk_Home/etc/users (for private searches)

grep -Hir "action.summary_index._name\s*=\s*<your summary index name here>" | grep savedsearches.conf

This would give you list of savedsearches.conf which contains the searches (which you need to open manually).

0 Karma

deepak02
Path Finder

Works 🙂

Awarded points for the additional info provided.

0 Karma

rphillips_splk
Splunk Employee
Splunk Employee

@deepak02 you can use the REST api endpoint for saved searches and look for those which have summary indexing enabled:

run this search:
| rest /servicesNS/-/-/saved/searches | search action.summary_index=1 | table title qualifiedSearch action.summary_index

0 Karma

deepak02
Path Finder

Works beautifully! Thankyou very much

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...