Knowledge Management

Troubles in the Summary Index. Error message of "malformed search" pops up

kanj
New Member

I am having the same error message "This saved search cannot perform summary indexing because it has a malformed search" while setting up the summary index.
- The search with lookup and macros runs perfectly and provides results.
- My lookups and macros in the search are set within permissions.
What else do I need to set/edit for Summary indexing?

Labels (1)
0 Karma

anmolpatel
Builder

Go to inspect job and review the search.log to begin with.

If you could share the spl, that would be helpful

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...

Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain

Boston may be buzzing this September with Splunk University and .conf25, but you don’t have to pack a bag to ...

Splunk Lantern’s Guide to The Most Popular .conf25 Sessions

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...