- Splunk Answers
- :
- Splunk Administration
- :
- Knowledge Management
- :
- Why does a Summary Index use the "main" index when...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Why does a Summary Index use the "main" index when I specified a different index?
Why does a Summary Index use the "main" index when I specified a completely different index? I have looked in inputs.conf and savedsearches.conf and cannot determine why/how the main index is being used. To be fair, we initially used main, but then decided to go with a completed different index name. Main still receives data and so does the new index.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
halbeisendv,
Have you made any progress on this issue? What version are you on? Are you on a Search Cluster?
I cannot find what is causing the behavior as it is seemingly very random.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
Data will land in the index mentioned in .conf files only, can you rechek or you can troubleshoot using "btool" command,
https://www.splunk.com/blog/2012/10/02/tips-and-tricks-for-the-new-guy.html
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
btool does not locate an inputs file with a reference to the main index.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
halbeisendv,
Have you found a resolution to the issue?
I am seeing a similar issue but it seems to be random (not consistent behavior at all)
What version are you dealing with? Is it a search cluster?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello JimGat_SSI: I think the resolution was that the stash sourcetype uses the main index -- not that I like that either, but now I know why I am seeing information in "main."
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@halbeisendv please share the config you have in saved search. How are you redirecting to main index ? Are you using the collect command ?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
it is un clear from your question if you mean to data being generated by a search and written to an index - meaning "summarized data", or to data that lands in splunk right from the source - "indexed data". by default, main is the default index if no other index is specified in inputs.conf. summary (the index) is the default summary index if no other index is specified in savedsearches.conf.
which one is it?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I mean the former -- data being generated by a search and written to a summary index. I suspect a user initially selected the main index to write to, but then changed their mind. So now, we have summary data being written to a new index and the main index. The problem is, I cannot find any reference to the main index.
.conf24 | Registration Open!
ICYMI - Check out the latest releases of Splunk Edge Processor
Introducing the 2024 SplunkTrust!
