Knowledge Management

Summary index data is missing .

Anantha123
Communicator

Summary Index have data from past 6 months . Suddenly i see data missing for 20 days in Aug month . This data was there before. Can you please help on how to get the data back .

I have tried disabling the Summary Index, Restart the Splunk and Enable the Summary Index. This process did not help me.

Any help is highly appreciated.

Thanks.
Anantha.

0 Karma
1 Solution

Anantha123
Communicator

I believe this has to do something with Retention period that we assign while creating Summary Index. Initially I gave as 1 month and so the data started disappearing slowely. I have created test_Summary_Index with 1yr of retention period and it all good .

View solution in original post

0 Karma

petersonjared
Explorer

That's the first place we looked but doesn't appear to be our issue.

0 Karma

Anantha123
Communicator

I believe this has to do something with Retention period that we assign while creating Summary Index. Initially I gave as 1 month and so the data started disappearing slowely. I have created test_Summary_Index with 1yr of retention period and it all good .

0 Karma

petersonjared
Explorer

We are having this EXACT same issue. The data was there, and it has just disappeared. What's odd as well as that it's a chunk of data in the middle of time and we still have data prior to and after the now missing data; that was there before.

We cannot backfill either as the base index has had the data roll off already.

We have a support case open and will be reporting this as another another customer is having the same issue out of no where.

0 Karma

harsmarvania57
SplunkTrust
SplunkTrust

Do you have data in summary index in Jun, Jul and Sep month? If yes then troubleshoot why data was missing for 20 days, someone disabled Scheduled search which was ingesting data in summary index OR scheduled search which was ingesting data in summary index skipped for 20 days (This is very unlikely) (These are only two possibilities but there might be more possibilities.) ?

As a last resort if raw data available in original index for month of Aug from which you are ingesting data into summary index then you can backfill data in summary index. Have a look at doc https://docs.splunk.com/Documentation/Splunk/7.3.1/Knowledge/Managesummaryindexgapsandoverlaps

Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...