Knowledge Management

Summary Index : Results not generated

mike7860
Explorer

I saved and scheduled a search by the name index usage. I am trying to use summary indexing but cannot get the results displayed. I have selected the default index as summary.

In in order to test the summary indexing performance, i am using the following search

index=summary search_name="index usage". The screen displayes no matching data.

If this information is useful, I have tried to schedule the search at evry 9:00 a.m.

Your help is highly recommended as I have been working on this issue for the past two weeks and still unable to resolve the issue.

Tags (1)
0 Karma

yannK
Splunk Employee
Splunk Employee
  • look at all your summary searches results with index=summary | stats count by search_name
  • try with underscore instead of spaces index=summary search_name="index_usage"
  • double check that you have permission to search on other indexes
  • look in other indexes index=* search_name="index*usage"

If you do not find any results :

  • test the search manually (to see the results)
  • check that the search ran a least one in the scheduler index=_internal source=*scheduler.log* "index*usage"
  • check for files stuck in the spooler $SPLUNK_HOME/var/run/spool/splunk (temporary csv files of the results ready to be indexed to the summary index, if they are not deleted after indexing, then they were not indexed.)
  • check that you can actually index things (in case of complex forwarding setup)

jonuwz
Influencer

Can you post the search that populates the summary index?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...