Knowledge Management

saved searches populates wrong summary index

my_splunk
Path Finder

In our 5.0.2 Splunk version installation we have many simultaneous summary index-populating searches.

Sometimes summary indexes are populated in wrong way. For example, summary index A have not only data from saved search populating this index, but also data from another saved search, configurated to populate index B for example.
This issue is randomic and not on same indexes.

We have already and many times checked events producted from single saved searches and we have not found problems; also in logs there are no errors.

Thanks

Tags (1)
0 Karma

magnuschill
New Member

I am experiencing the same issue, version 5.0.1. The search_name field and other additional fields that get created by the summary are all populated correctly, but the data source and index are incorrect.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...

Splunkbase Unveils New App Listing Management Public Preview

Splunkbase Unveils New App Listing Management Public PreviewWe're thrilled to announce the public preview of ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...