topic Running a scheduled search and saving the results to a summary index, how do I view the results as a table? in Splunk Search

Running a scheduled search and saving the results to a summary index, how do I view the results as a table?

monteirolopes — Mon, 02 May 2016 19:12:00 GMT

Hi,

I created a search that returns me a table with some values, follows:

... | table name, id, date

I scheduled my search to run every day at midnight and the results are saved in the summary index.
In my summary index, I see each table row as an event. Is this correct? How can I see the results like a table on the summary index?

Best regards,
Lopes.

Re: Running a scheduled search and saving the results to a summary index, how do I view the results as a table?

woodcock — Mon, 02 May 2016 20:16:58 GMT

It depends on which command you used to put it into the SI. It is all described here:

http://docs.splunk.com/Documentation/Splunk/6.0.2/Knowledge/Usesummaryindexing

Re: Running a scheduled search and saving the results to a summary index, how do I view the results as a table?

somesoni2 — Mon, 02 May 2016 20:54:19 GMT

You should be able to see data from your summary index using following query

index=yoursummaryindexname source=NameOfYOurSummaryIndexSearch | table name id date

Re: Running a scheduled search and saving the results to a summary index, how do I view the results as a table?

monteirolopes — Mon, 02 May 2016 21:06:19 GMT

I was not sure if I could use the normal commands, but I saw a note on the documentation talking about it.
"Note: You do not have to use the si- summary index search commands if you are proficient with the "old-school" way of creating summary-index-populating searches."

Thank you!