topic Re: Why is the "Enable summary indexing" option no longer available in 6.6.0? in Knowledge Management

Why is the "Enable summary indexing" option no longer available in 6.6.0?

sylim_splunk — Tue, 16 May 2017 16:49:22 GMT

I currently have several scheduled jobs which generate summarized data which gets inserted into the summary index. Then I upgraded to Splunk 6.6.0 and created a new summary report, but no longer is the "enable summary indexing" option available in the settings -> searches, reports, alerts -> report window.

Even the previous summary reports that I have configured don't have that option anymore. Even though they don't have the option, the previous ones continue to function correctly, gathering the summary data into the summary index. But the new one that I need to have working soon has no way for me to enable it's summary indexing.

Re: Why is the "Enable summary indexing" option no longer available in 6.6.0?

sylim_splunk — Tue, 29 Sep 2020 14:05:35 GMT

We are currently working on this to correct it. In the meantime could you please follow the manual steps?

Create your searchs/reports/alerts.
Then locate your config stanza in the savedsearches.conf, add the below;

action.summary_index = true
auto_summarize.dispatch.earliest_time ="set this by referencing the info from below"
https://docs.splunk.com/Documentation/Splunk/6.6.0/SearchReference/SearchTimeModifiers

Then $ ./bin/splunk _internal call /servicesNS/"user"/search/saved/searches/_reload

Re: Why is the "Enable summary indexing" option no longer available in 6.6.0?

jedwardgrow — Tue, 29 Sep 2020 14:39:04 GMT

In "$ ./bin/splunk _internal call /servicesNS//search/saved/searches/_reload", don't you need to specify the user who owns the saved search?

Should the reload call be:
$ ./bin/splunk _internal call /servicesNS/(user)/search/saved/searches/_reload

Note: I had to edit this to get the "(user)" to be saved properly in this comment. I assume splunk answers removed that from the original answer as well.

Re: Why is the "Enable summary indexing" option no longer available in 6.6.0?

dgthistle — Mon, 10 Jul 2017 15:17:38 GMT

Has summary indexing been fixed in 6.6.2?

Re: Why is the "Enable summary indexing" option no longer available in 6.6.0?

tvanry — Mon, 10 Jul 2017 15:22:50 GMT

I can confirm that this has been fixed in 6.6.2.

Re: Why is the "Enable summary indexing" option no longer available in 6.6.0?

tvanry — Mon, 10 Jul 2017 15:23:14 GMT

This problem has been fixed in 6.6.2.

Re: Why is the "Enable summary indexing" option no longer available in 6.6.0?

dgthistle — Mon, 10 Jul 2017 19:12:44 GMT

Thanks tvanry!

Re: Why is the "Enable summary indexing" option no longer available in 6.6.0?

osunjio — Wed, 30 Aug 2017 21:18:14 GMT

When i tried selecting a summary index, the particular index i want is not listed, even though i have access to the index. i could perform search on the index to be use for summary index, but its not appearing as the list of option to select from when enabling summary index for a report. Some other indexes that i have access to are also not appearing.. pls help

Re: Why is the "Enable summary indexing" option no longer available in 6.6.0?

bdenning2 — Wed, 30 Aug 2017 22:48:19 GMT

You need to have your indexes.conf file (where the indexes are defined) on your search head. Alternatively, in later versions you can click "advanced" and update the search macro directly with (index=whatever).

Re: Why is the "Enable summary indexing" option no longer available in 6.6.0?

mikeydee77 — Mon, 18 Sep 2017 14:16:46 GMT

It looks like I am facing this issue in 6.6.2. When saving a search I just get the following two dialog windows and enable summary indexing is not shown - or I can't see it. I have done this in earlier versions (4.5) without issue so I know roughly what I am doing.

sounds like might be a bug or am I missing something else?

Re: Why is the "Enable summary indexing" option no longer available in 6.6.0?

cygnetix — Mon, 18 Sep 2017 21:23:13 GMT

It's not under "edit schedule". Find your search in "Searches, Reports, and Alerts", click edit and you should see a "Edit Summary Indexing" option in the drop down.

Re: Why is the "Enable summary indexing" option no longer available in 6.6.0?

mikeydee77 — Tue, 19 Sep 2017 07:35:58 GMT

Thanks for replying cygnetix. You are spot on.

In case anyone else needs it the menu is in ...

Settings > knowledge > searches,reports and alerts and it is in the edit menu.

Re: Why is the "Enable summary indexing" option no longer available in 6.6.0?

Lowell — Thu, 04 Jan 2018 17:39:28 GMT

Is this broken again as of 7.0.1? The "Edit Summary Indexing" context menu for a report opens a blank box (no content), and for alerts, the appears to be no "Summary Indexing" alert action. What am I missing?

The above workaround only works if you have console (file-system) access. Setting those values via the "Advanced Edit" window has no effect.

Re: Why is the "Enable summary indexing" option no longer available in 6.6.0?

rickybails — Fri, 05 Jan 2018 16:56:45 GMT

I am still experiencing this problem in 6.6.5, i.e.
- the 'edit summary index' option in 'Settings -> searches, reports and alerts' is blank

Re: Why is the "Enable summary indexing" option no longer available in 6.6.0?

the_wolverine — Fri, 19 Oct 2018 00:59:55 GMT

Yes they broke it again.

Re: Why is the "Enable summary indexing" option no longer available in 6.6.0?

the_wolverine — Fri, 19 Oct 2018 01:04:48 GMT

The solution is the save the search as a Report. Once you save it, you can go back in and edit it to see the option to enable Summary indexing. If you save it as an Alert, the summary indexing option is missing.

Re: Why is the "Enable summary indexing" option no longer available in 6.6.0?

henriquelinsmey — Fri, 17 May 2019 02:10:24 GMT

The same issue detected on the new Splunk Enterprise 7.2.6.
Any new workaround as I can't give up Alerts for Reports as Throttle is required in my solution.

Re: Why is the "Enable summary indexing" option no longer available in 6.6.0?

dcascione — Wed, 30 Oct 2019 15:33:10 GMT

The "Edit Summary Indexing" Option appears to be missing in 7.24 as well...

Re: Why is the "Enable summary indexing" option no longer available in 6.6.0?

asusatapathy — Wed, 18 Aug 2021 13:09:13 GMT

Hi , Am using Splunk Enterprise Version:7.3.3. Still cant see drop down option for my saved search report even though I use below lines in my savedsearch.conf file.

action.summary_index = true

auto_summarize.dispatch.earliest_time = @w0