Knowledge Management

Why does a Summary Index use the "main" index when I specified a different index?

halbeisendv
Path Finder

Why does a Summary Index use the "main" index when I specified a completely different index? I have looked in inputs.conf and savedsearches.conf and cannot determine why/how the main index is being used. To be fair, we initially used main, but then decided to go with a completed different index name. Main still receives data and so does the new index.

0 Karma

JimGat_SSI
New Member

halbeisendv,

Have you made any progress on this issue? What version are you on? Are you on a Search Cluster?

I cannot find what is causing the behavior as it is seemingly very random.

0 Karma

pruthvikrishnap
Contributor

Hi,
Data will land in the index mentioned in .conf files only, can you rechek or you can troubleshoot using "btool" command,
https://www.splunk.com/blog/2012/10/02/tips-and-tricks-for-the-new-guy.html

0 Karma

halbeisendv
Path Finder

btool does not locate an inputs file with a reference to the main index.

0 Karma

JimGat_SSI
New Member

halbeisendv,

Have you found a resolution to the issue?

I am seeing a similar issue but it seems to be random (not consistent behavior at all)

What version are you dealing with? Is it a search cluster?

0 Karma

halbeisendv
Path Finder

Hello JimGat_SSI: I think the resolution was that the stash sourcetype uses the main index -- not that I like that either, but now I know why I am seeing information in "main."

0 Karma

DavidHourani
Super Champion

@halbeisendv please share the config you have in saved search. How are you redirecting to main index ? Are you using the collect command ?

0 Karma

adonio
Ultra Champion

it is un clear from your question if you mean to data being generated by a search and written to an index - meaning "summarized data", or to data that lands in splunk right from the source - "indexed data". by default, main is the default index if no other index is specified in inputs.conf. summary (the index) is the default summary index if no other index is specified in savedsearches.conf.
which one is it?

0 Karma

halbeisendv
Path Finder

I mean the former -- data being generated by a search and written to a summary index. I suspect a user initially selected the main index to write to, but then changed their mind. So now, we have summary data being written to a new index and the main index. The problem is, I cannot find any reference to the main index.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...