Summary index not being populated until saved search name is changed. [RESOLVED]

[jamesaarondevli]

Hi all,

I have created a saved search which populates a summary index. I am testing this saved search and need to be able to clean the index, re-run the saved search and review the results.

The problem I am having is that I can run the saved search once and verify the summary index has results, but subsequent runs return events in the Job page without actually placing those results into the summary index.

The fix I have identified is to clone and rename the saved search. But once again, after I've used this saved search once I can no longer re-use it until I clone and rename it.

I appreciate any help.

Regards,
James

[hazekamp · Accepted solution]

James,

I believe this is being caused by a known issue in 4.2.0/4.2.1 where a saved search loses it's schedule when edited via manager. Renaming the search is fixing your problem because it invalidates the local.meta causing the issue.

See also:
http://splunk-base.splunk.com/answers/22875/splunk-v422-fixes

[hazekamp]

FYI; This is resolved in 4.2.2 per release note "Scheduled saved search loses scheduled time when converted from private to global permissions (All apps). Scheduled time resets to None. (SPL-38616)"