topic Why is data summary not displaying? in Splunk Search

Why is data summary not displaying?

akankshayadav — Mon, 18 Apr 2022 14:39:53 GMT

When I am click on my data summary, it is not displaying anything just showing

Any suggestions?
Thanks.

Re: Data Summary

state_larson_ti — Mon, 18 Apr 2022 09:50:14 GMT

Good Day. I was curious if you had ever found an answer here. I noticed the same thing, logged in about 3 days later, and the data had been populated (but not for the data I had put in the day before. I assume there is a search that populates this data, but it only runs maybe 1/x per day or week.

Re: Data Summary

gcusello — Mon, 18 Apr 2022 09:55:53 GMT

Hi @akankshayadav,

I haven't your issue in my Splunk, which version are you using?

My only hint is to open a Case To Splunk Support.

Ciao and Happy Easter.

Giuseppe

Re: Data Summary

state_larson_ti — Mon, 18 Apr 2022 10:00:49 GMT

Actually a little more searching and I found the answer here (https://community.splunk.com/t5/Knowledge-Management/How-to-fix-misleading-quot-What-to-search-quot-Data-Summary-in/m-p/488404). I also on my experimental/learning box (latest version) had enabled (under Settings -> Roles -> Admin -> Indexes) the * (All non-internal indexes) and the _* (All internal indexes) to be default and this immediately allowed data summary to work and see all the indexes. I can see how, by default, you might not want to have this enabled for the admin account.

I think in courses you do, they may enable this by default for your accounts on non-internal indexes to make it easier for you to configure things, so I had not had to configure it myself.

Re: Why is data summary not displaying?

aliazaad — Tue, 31 Jan 2023 07:00:55 GMT

if you select index=main for your input

the problem will be solved