Knowledge Management
Highlighted

Summary index not being populated until saved search name is changed. [RESOLVED]

Path Finder

Hi all,

I have created a saved search which populates a summary index. I am testing this saved search and need to be able to clean the index, re-run the saved search and review the results.

The problem I am having is that I can run the saved search once and verify the summary index has results, but subsequent runs return events in the Job page without actually placing those results into the summary index.

The fix I have identified is to clone and rename the saved search. But once again, after I've used this saved search once I can no longer re-use it until I clone and rename it.

I appreciate any help.

Regards,
James

Tags (3)
0 Karma
Highlighted

Re: Summary index not being populated until saved search name is changed. [RESOLVED]

Builder

James,

I believe this is being caused by a known issue in 4.2.0/4.2.1 where a saved search loses it's schedule when edited via manager. Renaming the search is fixing your problem because it invalidates the local.meta causing the issue.

See also:
http://splunk-base.splunk.com/answers/22875/splunk-v422-fixes

View solution in original post

Highlighted

Re: Summary index not being populated until saved search name is changed. [RESOLVED]

Builder

FYI; This is resolved in 4.2.2 per release note "Scheduled saved search loses scheduled time when converted from private to global permissions (All apps). Scheduled time resets to None. (SPL-38616)"

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.