My scheduled search runs successfully, but why does it not populate the summary index?

[danwilkins]

We are on 6.3.3, I have a search that returns results when I run it, I have it scheduled to run and it shows that it successfully runs, however the data is not getting put in to the summary index.

The Search

index=##someindex## sourcetype=##sometype## virus definitions  | dedup Host_Name | eval definitiontime=substr(client_sequence,0,6) + "000000" | eval newdefdate=strptime(definitiontime,"%y%m%d%H%M") 
 | eval daysOld = floor((now() - newdefdate )/86400)
 | eval DefinitionStatus = case(daysOld = 0, "Current",daysOld = 1, "1 Day Old", daysOld <= 7, "2 to 7 Days Old",daysOld <= 14, "8 to 14 Days Old", daysOld <= 30, "15 to 30 Days Old", daysOld > 30, "Over 30 Days")
 | bucket _time span=1d
 | eval _time=now()
 | sistats count by DefinitionStatus

Job Inspector for Scheduled Search
This search has completed and has returned 6 results by scanning 104,841 events in 8.937 seconds.
It is an instance of the saved search: Summary - Security.
The following messages were returned by the search subsystem:
INFO: Successfully wrote file to '/opt/splunk/var/spool/splunk/##blahblah##.stash_new'.

[danwilkins · Accepted solution]

Thank you for the responses, if anyone is looking later, it was all my mistake but perhaps it will help someone else with limited understanding if they search.

After doing a test search

| stats count | eval count="VERYLONGANDUNIQUESTRING" | summaryindex index=summary

and then searching for it, turns out my understanding of how it indexed in to the summary index was wrong. It dates it according to the earliest log, not the latest or when the scheduled search runs.

index=summary VERYLONGANDUNIQUESTRING earliest=-30y latest=+20y

[yannK]

First of all, try ti search in the index you specified as summary.
index=mysummary
and verify that your role has the permissions to search on it.

Then
1 - check the folder $SPLUNK_HOME/var/spool/splunk
if you see it full of old files, then the SH is not able to monitor the summary results and forward them

2- then verify that your SH is configured to forward data to the indexers (like it's internal logs)

3- check splunkd.log on disk for errors

4 - check the name of your summary index, and verify it exists on the indexers.

[somesoni2]

Which index you're looking/expecting your summarized data to go?

[danwilkins]

I am expecting it in index=summary.

After doing a test search

| stats count | eval count="VERYLONGANDUNIQUESTRING" | summaryindex index=summary

and then searching for it, turns out my understanding of how it indexed in to the summary index was wrong. It dates it according to the earliest log, not the latest or when the scheduled search runs.

index=summary VERYLONGANDUNIQUESTRING earliest=-30y latest=+20y