Hi !
Running Splunk 6.2, i have a problem with Summary indexing and extra fields not working as expected.
I have a scheduled search which generates summary data in a dedicated index using an extra fields: report=my_report
When i search over the index and the summary report, like:
index=my_index report=my_report
Results are ok BUT Splunk scans for all events of the index during the time range, like if the report fields would not be an indexed field but an extracted field.
For example, my report returns a few hundreds events but Splunk searches for millions of events before returning the result...
If i filter over the "source" field instead of the report extra fields, then the search only takes a few seconds, returning same number of events but scanning only required events !
index=my_index source=name_of_the_schedules_search
Is there anything i am missing ? I don't remember i had this problem with previous release
Thank you very much for your help!
Guilhem
