topic sourcetypes not displaying on Summary screen in Getting Data In

sourcetypes not displaying on Summary screen

wildbill4 — Thu, 06 Sep 2012 11:43:24 GMT

When looking at the Summary screen Splunk is not displaying any sourcetypes. Sometimes it will appear after awhile.

Re: sourcetypes not displaying on Summary screen

Drainy — Thu, 06 Sep 2012 13:21:42 GMT

By default the summary screen will only display data in the default (main) index. You need to edit the XML slightly to add more sources to it if you have multiple indexes.

Also it can take a while after indexing new data for it to sometimes show on there.

Re: sourcetypes not displaying on Summary screen

Inayath_khan — Wed, 30 Sep 2020 01:19:03 GMT

By default , data summary screen will show only the data that is ingested in main index which means only the host,source & sourcetype which belongs to main index will be visible in the data summary. To override this , allow non_internal_indexes to be searchable by default. You can do this by navigating to settings --> Access controls --->roles ---> Select the current assigned role --->Indexes searched by default (Add the non_internal_indexes under selected indexes)---> save . Now refresh the page and navigate to data summary. There you go!!