Knowledge Management

Troubles in the Summary Index. Error message of "malformed search" pops up

kanj
New Member

I am having the same error message "This saved search cannot perform summary indexing because it has a malformed search" while setting up the summary index.
- The search with lookup and macros runs perfectly and provides results.
- My lookups and macros in the search are set within permissions.
What else do I need to set/edit for Summary indexing?

Labels (1)
0 Karma

anmolpatel
Builder

Go to inspect job and review the search.log to begin with.

If you could share the spl, that would be helpful

0 Karma
Get Updates on the Splunk Community!

.conf25 Registration is OPEN!

Ready. Set. Splunk! Your favorite Splunk user event is back and better than ever. Get ready for more technical ...

Detecting Cross-Channel Fraud with Splunk

This article is the final installment in our three-part series exploring fraud detection techniques using ...

Splunk at Cisco Live 2025: Learning, Innovation, and a Little Bit of Mr. Brightside

Pack your bags (and maybe your dancing shoes)—Cisco Live is heading to San Diego, June 8–12, 2025, and Splunk ...