topic Re: How to fix misleading "What to search"/Data Summary in Search & Reporting? in Knowledge Management

How to fix misleading "What to search"/Data Summary in Search & Reporting?

ricotries — Sun, 07 Jun 2020 01:16:19 GMT

I have been working with new inputs for a testing environment and I noticed that one point the Data Summary said that there are 10 events indexed with the earliest and latest event being 2 months ago. At first I thought that the data indexed had been erased, but after checking some custom dashboards, executing searches, and checking the server's storage, all the data is still there. Why is the Data Summary not reflecting the reality of the amount of data indexed? It was working fine earlier in the day and the only changes I did were in inputs.conf and props.conf, I didn't change the configuration of the server or the indexes.

Running 7.3.4 on a single-instance deployment.

Re: How to fix misleading "What to search"/Data Summary in Search & Reporting?

DalJeanis — Tue, 28 Apr 2020 20:22:33 GMT

One possibility is that you may have temporarily had an indexer off line.

Re: How to fix misleading "What to search"/Data Summary in Search & Reporting?

ricotries — Tue, 28 Apr 2020 20:45:52 GMT

I am able to search logs in the past 5 minutes with no issue and Data Summary still shows 10 events from 2 months ago.

Re: How to fix misleading "What to search"/Data Summary in Search & Reporting?

ricotries — Wed, 29 Apr 2020 11:39:31 GMT

I don't know what triggered this issue to occur, but going into Settings > Users and Authentication > Access Controls > Roles and under any of the roles enabling "All non-internal indexes" as a Default fixes this.