Knowledge Management
Highlighted

Summary Index : Results not generated

Explorer

I saved and scheduled a search by the name index usage. I am trying to use summary indexing but cannot get the results displayed. I have selected the default index as summary.

In in order to test the summary indexing performance, i am using the following search

index=summary search_name="index usage". The screen displayes no matching data.

If this information is useful, I have tried to schedule the search at evry 9:00 a.m.

Your help is highly recommended as I have been working on this issue for the past two weeks and still unable to resolve the issue.

Tags (1)
0 Karma
Highlighted

Re: Summary Index : Results not generated

Influencer

Can you post the search that populates the summary index?

0 Karma
Highlighted

Re: Summary Index : Results not generated

Splunk Employee
Splunk Employee
  • look at all your summary searches results with index=summary | stats count by search_name
  • try with underscore instead of spaces index=summary search_name="index_usage"
  • double check that you have permission to search on other indexes
  • look in other indexes index=* search_name="index*usage"

If you do not find any results :

  • test the search manually (to see the results)
  • check that the search ran a least one in the scheduler index=_internal source=*scheduler.log* "index*usage"
  • check for files stuck in the spooler $SPLUNK_HOME/var/run/spool/splunk (temporary csv files of the results ready to be indexed to the summary index, if they are not deleted after indexing, then they were not indexed.)
  • check that you can actually index things (in case of complex forwarding setup)