Knowledge Management

Troubles in the Summary Index. Error message of "malformed search" pops up

kanj
New Member

I am having the same error message "This saved search cannot perform summary indexing because it has a malformed search" while setting up the summary index.
- The search with lookup and macros runs perfectly and provides results.
- My lookups and macros in the search are set within permissions.
What else do I need to set/edit for Summary indexing?

Labels (1)
0 Karma

anmolpatel
Builder

Go to inspect job and review the search.log to begin with.

If you could share the spl, that would be helpful

0 Karma
Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...