Knowledge Management
Highlighted

Why is the "Enable summary indexing" option no longer available in 6.6.0?

Splunk Employee
Splunk Employee

I currently have several scheduled jobs which generate summarized data which gets inserted into the summary index. Then I upgraded to Splunk 6.6.0 and created a new summary report, but no longer is the "enable summary indexing" option available in the settings -> searches, reports, alerts -> report window.

Even the previous summary reports that I have configured don't have that option anymore. Even though they don't have the option, the previous ones continue to function correctly, gathering the summary data into the summary index. But the new one that I need to have working soon has no way for me to enable it's summary indexing.

Highlighted

Re: Why is the "Enable summary indexing" option no longer available in 6.6.0?

Splunk Employee
Splunk Employee

We are currently working on this to correct it. In the meantime could you please follow the manual steps?

  1. Create your searchs/reports/alerts.
  2. Then locate your config stanza in the savedsearches.conf, add the below;

action.summaryindex = true
auto
summarize.dispatch.earliest_time ="set this by referencing the info from below"
https://docs.splunk.com/Documentation/Splunk/6.6.0/SearchReference/SearchTimeModifiers

Then $ ./bin/splunk internal call /servicesNS/"user"/search/saved/searches/reload

View solution in original post

Highlighted

Re: Why is the "Enable summary indexing" option no longer available in 6.6.0?

New Member

In "$ ./bin/splunk internal call /servicesNS//search/saved/searches/reload", don't you need to specify the user who owns the saved search?

Should the reload call be:
$ ./bin/splunk internal call /servicesNS/(user)/search/saved/searches/reload

Note: I had to edit this to get the "(user)" to be saved properly in this comment. I assume splunk answers removed that from the original answer as well.

0 Karma
Highlighted

Re: Why is the "Enable summary indexing" option no longer available in 6.6.0?

New Member

Has summary indexing been fixed in 6.6.2?

0 Karma
Highlighted

Re: Why is the "Enable summary indexing" option no longer available in 6.6.0?

Engager

I can confirm that this has been fixed in 6.6.2.

0 Karma
Highlighted

Re: Why is the "Enable summary indexing" option no longer available in 6.6.0?

Engager

This problem has been fixed in 6.6.2.

0 Karma
Highlighted

Re: Why is the "Enable summary indexing" option no longer available in 6.6.0?

New Member

Thanks tvanry!

0 Karma
Highlighted

Re: Why is the "Enable summary indexing" option no longer available in 6.6.0?

New Member

When i tried selecting a summary index, the particular index i want is not listed, even though i have access to the index. i could perform search on the index to be use for summary index, but its not appearing as the list of option to select from when enabling summary index for a report. Some other indexes that i have access to are also not appearing.. pls help

0 Karma
Highlighted

Re: Why is the "Enable summary indexing" option no longer available in 6.6.0?

Engager

You need to have your indexes.conf file (where the indexes are defined) on your search head. Alternatively, in later versions you can click "advanced" and update the search macro directly with (index=whatever).

0 Karma
Highlighted

Re: Why is the "Enable summary indexing" option no longer available in 6.6.0?

Explorer

It looks like I am facing this issue in 6.6.2. When saving a search I just get the following two dialog windows and enable summary indexing is not shown - or I can't see it. I have done this in earlier versions (4.5) without issue so I know roughly what I am doing.

alt text

alt text

sounds like might be a bug or am I missing something else?

0 Karma