Getting Data In

sourcetypes not displaying on Summary screen

wildbill4
Path Finder

When looking at the Summary screen Splunk is not displaying any sourcetypes. Sometimes it will appear after awhile.

Tags (1)
0 Karma
1 Solution

Drainy
Champion

By default the summary screen will only display data in the default (main) index. You need to edit the XML slightly to add more sources to it if you have multiple indexes.

Also it can take a while after indexing new data for it to sometimes show on there.

View solution in original post

0 Karma

Inayath_khan
Path Finder

By default , data summary screen will show only the data that is ingested in main index which means only the host,source & sourcetype which belongs to main index will be visible in the data summary. To override this , allow non_internal_indexes to be searchable by default. You can do this by navigating to settings --> Access controls --->roles ---> Select the current assigned role --->Indexes searched by default (Add the non_internal_indexes under selected indexes)---> save . Now refresh the page and navigate to data summary. There you go!!

0 Karma

Drainy
Champion

By default the summary screen will only display data in the default (main) index. You need to edit the XML slightly to add more sources to it if you have multiple indexes.

Also it can take a while after indexing new data for it to sometimes show on there.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...