sourcetypes not displaying on Summary screen

[wildbill4]

When looking at the Summary screen Splunk is not displaying any sourcetypes. Sometimes it will appear after awhile.

[Inayath_khan]

By default , data summary screen will show only the data that is ingested in main index which means only the host,source & sourcetype which belongs to main index will be visible in the data summary. To override this , allow non_internal_indexes to be searchable by default. You can do this by navigating to settings --> Access controls --->roles ---> Select the current assigned role --->Indexes searched by default (Add the non_internal_indexes under selected indexes)---> save . Now refresh the page and navigate to data summary. There you go!!

[Drainy · Accepted solution]

By default the summary screen will only display data in the default (main) index. You need to edit the XML slightly to add more sources to it if you have multiple indexes.

Also it can take a while after indexing new data for it to sometimes show on there.