https://community.splunk.com/t5/Knowledge-Management/Capability-required-to-index-quot-summary-quot-to-perform/m-p/426545#M3810 <P>what is "Publisher" role?<BR /> to put data in a summary index you will need the <CODE>run_collect</CODE> capability<BR /> if you have the scheduling search capability, you can add an action to send the data to summary index that way</P> <P>read more here:<BR /> <A href="https://docs.splunk.com/Documentation/Splunk/7.2.6/Security/Rolesandcapabilities">https://docs.splunk.com/Documentation/Splunk/7.2.6/Security/Rolesandcapabilities</A></P> <P>hope it helps</P> Fri, 26 Apr 2019 02:27:20 GMT adonio 2019-04-26T02:27:20Z https://community.splunk.com/t5/Knowledge-Management/Capability-required-to-index-quot-summary-quot-to-perform/m-p/426544#M3809 <P>Dears,</P> <P>What capability is required for a person with publisher role to use index "summary" to store summary indexing?</P> <P>Regards,<BR /> Sakthi</P> Thu, 25 Apr 2019 14:37:19 GMT https://community.splunk.com/t5/Knowledge-Management/Capability-required-to-index-quot-summary-quot-to-perform/m-p/426544#M3809 sakthiganesht 2019-04-25T14:37:19Z https://community.splunk.com/t5/Knowledge-Management/Capability-required-to-index-quot-summary-quot-to-perform/m-p/426545#M3810 <P>what is "Publisher" role?<BR /> to put data in a summary index you will need the <CODE>run_collect</CODE> capability<BR /> if you have the scheduling search capability, you can add an action to send the data to summary index that way</P> <P>read more here:<BR /> <A href="https://docs.splunk.com/Documentation/Splunk/7.2.6/Security/Rolesandcapabilities">https://docs.splunk.com/Documentation/Splunk/7.2.6/Security/Rolesandcapabilities</A></P> <P>hope it helps</P> Fri, 26 Apr 2019 02:27:20 GMT https://community.splunk.com/t5/Knowledge-Management/Capability-required-to-index-quot-summary-quot-to-perform/m-p/426545#M3810 adonio 2019-04-26T02:27:20Z https://community.splunk.com/t5/Knowledge-Management/Capability-required-to-index-quot-summary-quot-to-perform/m-p/426546#M3811 <P>@adonio run_collect capability is provided and still I do not see summary in the list of index.</P> <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/6938i0635F82704AD97D3/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> <P>Even before adding run_collect capability I was able to point the summary index to other index (except summary). Kindly let me know if something is wrong here and explain to do it the right way. Thank you.</P> Fri, 26 Apr 2019 07:29:10 GMT https://community.splunk.com/t5/Knowledge-Management/Capability-required-to-index-quot-summary-quot-to-perform/m-p/426546#M3811 sakthiganesht 2019-04-26T07:29:10Z https://community.splunk.com/t5/Knowledge-Management/Capability-required-to-index-quot-summary-quot-to-perform/m-p/426547#M3812 <P>do you have schedule_search capability?</P> Fri, 26 Apr 2019 13:32:12 GMT https://community.splunk.com/t5/Knowledge-Management/Capability-required-to-index-quot-summary-quot-to-perform/m-p/426547#M3812 adonio 2019-04-26T13:32:12Z https://community.splunk.com/t5/Knowledge-Management/Capability-required-to-index-quot-summary-quot-to-perform/m-p/426548#M3813 <P>@adonio : yes I do</P> Fri, 26 Apr 2019 14:00:50 GMT https://community.splunk.com/t5/Knowledge-Management/Capability-required-to-index-quot-summary-quot-to-perform/m-p/426548#M3813 sakthiganesht 2019-04-26T14:00:50Z