Knowledge Management

Summary index not being populated until saved search name is changed. [RESOLVED]

jamesaarondevli
Path Finder

Hi all,

I have created a saved search which populates a summary index. I am testing this saved search and need to be able to clean the index, re-run the saved search and review the results.

The problem I am having is that I can run the saved search once and verify the summary index has results, but subsequent runs return events in the Job page without actually placing those results into the summary index.

The fix I have identified is to clone and rename the saved search. But once again, after I've used this saved search once I can no longer re-use it until I clone and rename it.

I appreciate any help.

Regards,
James

Tags (3)
0 Karma
1 Solution

hazekamp
Builder

James,

I believe this is being caused by a known issue in 4.2.0/4.2.1 where a saved search loses it's schedule when edited via manager. Renaming the search is fixing your problem because it invalidates the local.meta causing the issue.

See also:
http://splunk-base.splunk.com/answers/22875/splunk-v422-fixes

View solution in original post

hazekamp
Builder

James,

I believe this is being caused by a known issue in 4.2.0/4.2.1 where a saved search loses it's schedule when edited via manager. Renaming the search is fixing your problem because it invalidates the local.meta causing the issue.

See also:
http://splunk-base.splunk.com/answers/22875/splunk-v422-fixes

hazekamp
Builder

FYI; This is resolved in 4.2.2 per release note "Scheduled saved search loses scheduled time when converted from private to global permissions (All apps). Scheduled time resets to None. (SPL-38616)"

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>