Splunk 6.6.2 -- writing data to custom summary index

[alekksi]

Hi all,

We upgraded to 6.6.1 recently which removed the ability to write to summary indexes. With 6.6.2, this has been brought back, but I'm unable to select any custom created summary indexes. Instead of at least 10 indexes in the drop-down, I can see four (history, main, summary, splunklogger).

Is this a known issue? Is this by design? We use summary indexes quite extensively, so we would like this feature returned.

Best regards,
Alex

[sylim_splunk]

Fixed in 6.6.5+ & 7.0.2+, soon to be released. In the meantime find the workaround Yann suggested.

[yannK]

My bad, the question was about 6.2.2 and the replacement summary indexing search options.
It appears that the search-head UI only show the indexes defined locally, not the indexes that exists on the indexers or defined on the cluster-master.

• Workaround, create a dummy local index with the same name on the search-head. the index will now be an option on the drop list, and the search-head will not index the events locally to those indexes, but forward to the indexers (if you setup an outputs)

[yannK]

The UI to edit search with summary indexing was removed in 6.6*
A replacement is available in 6.6.2, under the searches options.
see SPL-141862, SPL-140361
http://docs.splunk.com/Documentation/Splunk/6.6.2/ReleaseNotes/6.6.2

Otherwise the workaround is to use the "advanced edit" menu in the manager, or edit the savedsearches.conf and specify all the required fields for summary indexing

example:

[mysearchname]
action.summary_index  = 1
action.summary_index._name = index_destination
alert_condition =
counttype = number of events
quantity = 0
relation = greater than

[rjthibod]

It is probably just a bug in the UI. You should be able to do it by editing the config file savedsearches.conf and this option.

action.summary_index._name = <ENTER_CUSTOM_NAME>