Knowledge Management

summary index not populated

sbsbb
Builder

I try to make a search with a timechart , run it every 15 minutes, and indexing the result.

Query works, and returns data, but if I try to search
index=summary search_name="scheduled_search_name"

I get no data ?

Tags (2)

gkanapathy
Splunk Employee
Splunk Employee

Yes, if you've run your search as you've said, with summary indexing selected and a valid index selected to write to, then you should be okay. It is possible that

  • you don't have permissions to the index your wrote to, as you suggested
  • the index doesn't exist so the summary couldn't be saved
  • the summary is forwarded to a different indexer, and you're not set up to query that indexer (which is a complicated version of the permissions problem essentially)
  • there are deeper config issues, though those would be considered abnormal

sbsbb
Builder

Thank you so much for telling me I'm a dumb newbie, that helps a lot !

I think I can't see the logs because of user policy, we have a big shared system, so I don't have access to everything.

I've scheduled the search, (and I see it has been executed), and checked "Summary Indexing" "Enabled"
If I need something in my query for having this to work, it maybe what I'm missing....

0 Karma

Ayn
Legend

First of all, I don't see anything that shows you actually are writing events to a summary index in your search. You only say that you have a query that returns results.

Secondly, if you don't see ANY of the logs yannK is talking about you're in some serious trouble (or more likely, don't really know your way around Splunk, which can be understandable but is the real problem that should be addressed first before you dive into this more thoroughly)

0 Karma

sbsbb
Builder

I made a scheduled search, ending with | timechart span="1m" count by field1... The query returns results, but searching the index ist empty...

I can't see any of the logs specified in the first answer.

0 Karma

yannK
Splunk Employee
Splunk Employee

1 - verify that the scheduled search ran

index=_internal source=*scheduler.log

2 -check in for warnings about the spooler

index=_internal source=*splunkd.log "*spool*"

3- double check if your server is indexing locally or forwarding to another indexer

gkanapathy
Splunk Employee
Splunk Employee

You probably need to provide more information than this to get a helpful answer. For example, how are you "indexing the result"? Is there anything in the summary at all? etc.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...