https://community.splunk.com/t5/Splunk-Search/Can-you-help-me-with-summary-index-field-issue/m-p/456424#M129022 <P>In the first place, you should be creating summary data for the summary index. Re-indexing a shorter version of all or even a filtered subset is extremely redundant, unnecessary and not the purpose of a summary index.<BR /> All that said, <CODE>| table *</CODE> includes many metadata fields that should not be included in a summary index including all the "_" fields. Given that you have said the number of fields is quite large, it is hard to imagine a case where such belongs in a summary index. But if you must, you may want to try adding a <CODE>| fields - _*</CODE> to remove the underscore fields and a few others like sourcetype, host, source, index, etc.<BR /> Also, ensure that your search head is forwarding to the IDX tier so that you take advantage of the parallelization. Also, make sure that you are using <CODE>collect</CODE> instead of <CODE>tscollect</CODE>.</P> Wed, 12 Sep 2018 23:23:50 GMT landen99 2018-09-12T23:23:50Z https://community.splunk.com/t5/Splunk-Search/Can-you-help-me-with-summary-index-field-issue/m-p/456423#M129021 <P>Hello,</P> <P>I have created a scheduled search which populates a summary index from a custom index.</P> <P>My main custom index has around 100 fields, but those fields are not appearing in the summary index. Only host and source source type fields are present in the summary index.</P> <P>When i tried adding table field1, field2, etc in the scheduled search query, then those mentioned fields were appearing in the summary index. But when i use table * in the search query, i am not getting any fields in the summary index.</P> <P>Currently, I have to explicitly specify "table field names" in the query, which is tedious considering the number of fields.</P> <P>IS there any way to fix this issue?</P> Wed, 12 Sep 2018 13:03:52 GMT https://community.splunk.com/t5/Splunk-Search/Can-you-help-me-with-summary-index-field-issue/m-p/456423#M129021 chinmayc469 2018-09-12T13:03:52Z https://community.splunk.com/t5/Splunk-Search/Can-you-help-me-with-summary-index-field-issue/m-p/456424#M129022 <P>In the first place, you should be creating summary data for the summary index. Re-indexing a shorter version of all or even a filtered subset is extremely redundant, unnecessary and not the purpose of a summary index.<BR /> All that said, <CODE>| table *</CODE> includes many metadata fields that should not be included in a summary index including all the "_" fields. Given that you have said the number of fields is quite large, it is hard to imagine a case where such belongs in a summary index. But if you must, you may want to try adding a <CODE>| fields - _*</CODE> to remove the underscore fields and a few others like sourcetype, host, source, index, etc.<BR /> Also, ensure that your search head is forwarding to the IDX tier so that you take advantage of the parallelization. Also, make sure that you are using <CODE>collect</CODE> instead of <CODE>tscollect</CODE>.</P> Wed, 12 Sep 2018 23:23:50 GMT https://community.splunk.com/t5/Splunk-Search/Can-you-help-me-with-summary-index-field-issue/m-p/456424#M129022 landen99 2018-09-12T23:23:50Z