Knowledge Management

Unable to save summary search because summary index is missing

the_wolverine
Champion

Our summary index is not recognized in UI when attempt to save a scheduled search to write to it. These indexes are just like any other index.

ERROR SavedSearchAdminHandler - Index name=summary_test does not exist. The summary index must exist in order for a scheduled search to populate it.

False. The index exists.

We use a SH_POOL and Distributed search. Summary indexed data will go to indexers.

We are being told that a "stub" index needs to be created on the SH -- why? Why is Splunk able to write to any other index but not a summary index without a "stub" being created on the SH? It appears to be a bug.

yannK
Splunk Employee
Splunk Employee

If the index is created on the indexers, but not on the search-heads, the SH may complain when you are trying to select it.
Quick workaround, define the index on the SH, but forwar the data to the indexer anyway.

ben_leung
Builder

Is this issue still in version 6.3+ ?

0 Karma

the_wolverine
Champion

What is the reason for this and where is the documentation that explains the issue?

0 Karma

jrodman
Splunk Employee
Splunk Employee

This is a current limitation in the Splunk UI.

0 Karma
Get Updates on the Splunk Community!

Learn Splunk Insider Insights, Do More With Gen AI, & Find 20+ New Use Cases You Can ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Buttercup Games: Further Dashboarding Techniques (Part 7)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...