https://community.splunk.com/t5/Knowledge-Management/When-summary-indexing-job-completed-the-result-is-not-written-to/m-p/307103#M2686 <P>When splunk run scheduled job which generate result to summary index, once the result is generated, it will write the result into a temporary directory /opt/splunk/var/spool/splunk with a file suffix stash_new. </P> <P>(For example, RMD541b14054534417ff_2113273468.stash_new)</P> <P>Splunk by default will monitor this directory with this stanza.</P> <PRE><CODE>[batch:///home/daniel/splunk-idx/var/spool/splunk/...stash_new] sourcetype = stash_new </CODE></PRE> <P>From your description, as you didn't change the scheduled job, one possibility is the sourcetype = stash_new in props.conf is altered by other stanza.</P> <P>You can check it by using this btool command.<BR /> splunk cmd btool --debug props list stash_new</P> <P>If the returned result have some configuration from local directory, you may need to check whether that configuration is really for stash_new or not.</P> <P>One example that may break the summary indexing logic is that you accidentally write the followng into local/props.conf without any stanza. That configure will applied to [stash_new] as well.</P> <PRE><CODE>cat etc/system/local/props.conf INDEXED_EXTRACTIONS = CSV ## As above configure is not under any stanza, it will apply to all other stanza. Don't configure like this. </CODE></PRE> Tue, 29 Sep 2020 14:52:30 GMT daniel_splunk 2020-09-29T14:52:30Z https://community.splunk.com/t5/Knowledge-Management/When-summary-indexing-job-completed-the-result-is-not-written-to/m-p/307102#M2685 <P>When summary index job run completed, the results did't send to index=summary as we setup in schedule search job. But Splunk send summary results to index "main". It had been working before and I didn't change anything.</P> Fri, 14 Jul 2017 08:28:44 GMT https://community.splunk.com/t5/Knowledge-Management/When-summary-indexing-job-completed-the-result-is-not-written-to/m-p/307102#M2685 daniel_splunk 2017-07-14T08:28:44Z https://community.splunk.com/t5/Knowledge-Management/When-summary-indexing-job-completed-the-result-is-not-written-to/m-p/307103#M2686 <P>When splunk run scheduled job which generate result to summary index, once the result is generated, it will write the result into a temporary directory /opt/splunk/var/spool/splunk with a file suffix stash_new. </P> <P>(For example, RMD541b14054534417ff_2113273468.stash_new)</P> <P>Splunk by default will monitor this directory with this stanza.</P> <PRE><CODE>[batch:///home/daniel/splunk-idx/var/spool/splunk/...stash_new] sourcetype = stash_new </CODE></PRE> <P>From your description, as you didn't change the scheduled job, one possibility is the sourcetype = stash_new in props.conf is altered by other stanza.</P> <P>You can check it by using this btool command.<BR /> splunk cmd btool --debug props list stash_new</P> <P>If the returned result have some configuration from local directory, you may need to check whether that configuration is really for stash_new or not.</P> <P>One example that may break the summary indexing logic is that you accidentally write the followng into local/props.conf without any stanza. That configure will applied to [stash_new] as well.</P> <PRE><CODE>cat etc/system/local/props.conf INDEXED_EXTRACTIONS = CSV ## As above configure is not under any stanza, it will apply to all other stanza. Don't configure like this. </CODE></PRE> Tue, 29 Sep 2020 14:52:30 GMT https://community.splunk.com/t5/Knowledge-Management/When-summary-indexing-job-completed-the-result-is-not-written-to/m-p/307103#M2686 daniel_splunk 2020-09-29T14:52:30Z