topic Re: Summary Index : Results not generated in Knowledge Management

Summary Index : Results not generated

mike7860 — Mon, 26 Nov 2012 15:16:44 GMT

I saved and scheduled a search by the name index usage. I am trying to use summary indexing but cannot get the results displayed. I have selected the default index as summary.

In in order to test the summary indexing performance, i am using the following search

index=summary search_name="index usage". The screen displayes no matching data.

If this information is useful, I have tried to schedule the search at evry 9:00 a.m.

Your help is highly recommended as I have been working on this issue for the past two weeks and still unable to resolve the issue.

Re: Summary Index : Results not generated

jonuwz — Mon, 26 Nov 2012 15:58:51 GMT

Can you post the search that populates the summary index?

Re: Summary Index : Results not generated

yannK — Mon, 26 Nov 2012 17:40:09 GMT

look at all your summary searches results with index=summary | stats count by search_name
try with underscore instead of spaces index=summary search_name="index_usage"
double check that you have permission to search on other indexes
look in other indexes index=* search_name="index*usage"

If you do not find any results :

test the search manually (to see the results)
check that the search ran a least one in the scheduler index=_internal source=*scheduler.log* "index*usage"
check for files stuck in the spooler $SPLUNK_HOME/var/run/spool/splunk (temporary csv files of the results ready to be indexed to the summary index, if they are not deleted after indexing, then they were not indexed.)
check that you can actually index things (in case of complex forwarding setup)