Knowledge Management

Scheduled saved search for filling Summary index via Cron, not running

Dark_Ichigo
Builder

I have created a summary index and a saved search to run via cron configured in saved_searches.conf, the only issue is that its not running at the specified time and if it managed to run, it doesn't fill up the summary index, UNLESS I manually click on "Jobs" and select the scheduled saved search thats running in the background and run it my self, then it will be successfully filled.

What could be the reason for this behaviour?

I have taken a look at some of the other questions but they dont seem to solve my issue.

Below is a copy of one of my scheduled saved Searches:

[Saved_Search]
action.email.inline = 1
action.summary_index = 0
action.summary_index._name = Summary
alert.severity = 2
alert.suppress = 1
alert.suppress.period = 1h
alert.track = 1
cron_schedule = 07 15 * * *
description = <Description>
dispatch.earliest_time = -29d@d
dispatch.latest_time = now
enableSched = 0
realtime_schedule = 1
search = `saved_search`
0 Karma
1 Solution

Ayn
Legend

You've set action.summary_index to 0.

EDIT: ...and also you've set enableSched to 0.

View solution in original post

Ayn
Legend

You've set action.summary_index to 0.

EDIT: ...and also you've set enableSched to 0.

Get Updates on the Splunk Community!

Celebrating Fast Lane: 2025 Authorized Learning Partner of the Year

At .conf25, Splunk proudly recognized Fast Lane as the 2025 Authorized Learning Partner of the Year. This ...

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...