Summary index data is missing .

[Anantha123]

Summary Index have data from past 6 months . Suddenly i see data missing for 20 days in Aug month . This data was there before. Can you please help on how to get the data back .

I have tried disabling the Summary Index, Restart the Splunk and Enable the Summary Index. This process did not help me.

Any help is highly appreciated.

Thanks.
Anantha.

[petersonjared]

That's the first place we looked but doesn't appear to be our issue.

[Anantha123 · Accepted solution]

I believe this has to do something with Retention period that we assign while creating Summary Index. Initially I gave as 1 month and so the data started disappearing slowely. I have created test_Summary_Index with 1yr of retention period and it all good .

[petersonjared]

We are having this EXACT same issue. The data was there, and it has just disappeared. What's odd as well as that it's a chunk of data in the middle of time and we still have data prior to and after the now missing data; that was there before.

We cannot backfill either as the base index has had the data roll off already.

We have a support case open and will be reporting this as another another customer is having the same issue out of no where.

[harsmarvania57]

Do you have data in summary index in Jun, Jul and Sep month? If yes then troubleshoot why data was missing for 20 days, someone disabled Scheduled search which was ingesting data in summary index OR scheduled search which was ingesting data in summary index skipped for 20 days (This is very unlikely) (These are only two possibilities but there might be more possibilities.) ?

As a last resort if raw data available in original index for month of Aug from which you are ingesting data into summary index then you can backfill data in summary index. Have a look at doc https://docs.splunk.com/Documentation/Splunk/7.3.1/Knowledge/Managesummaryindexgapsandoverlaps