Can you help me with my query involving a saved search and summary indexing?

[Log_wrangler]

Hi,

I am trying to understand how and where Splunk stores data from saved searches that populates a new summary index.

Scenario:

Another admin set up a number of queries/searches against 3 different indexes to run on different time schedules (like once a week or every 4 hours). These searches alert on specific events and send alert emails when there is a hit. Additionally, the search results are sent to a "summary" (not sure if that is the correct term) index that combines all the different query results under one index, which is then used to create a dashboard.

So I have 10 separate searches that queries 3 different indexes.

When an event is found, the results are being sent to a "new_index', which is not defined on the indexers > indexes.conf, but only on the search head...

On the search head, I can find the new_index in /opt/splunk/var/lib/splunk/new_index... , but I don't see the 'new_index' on the indexers... Is that possible? where is that data being stored?

I have looked at the documentation but in this case I am confused. I thought summary indexes were also saved on the indexers.

Please advise.

Thank you

[Vijeta · Accepted solution]

It is stored on the index on your search head. You can create indexes both on the search head and the indexer. The summary indexes are used to populate the aggregate data based on your query so the dashboard needs to search through a defined set of data with minimal query.

Summary index can also be defined on indexer instead of the search head (usually done in clustered set up). Any index if you define as summary index will collect the data in sourcetype 'stash' , and it is not counted against the license.

[Log_wrangler]

Thank you for the explanation.
So the only place I see data is /opt/splunk/var/lib/splunk/new_index on the search head is that the correct location in this case?

[Vijeta]

This is the correct location for an index.