Knowledge Management

summary index not populated

sbsbb
Builder

I try to make a search with a timechart , run it every 15 minutes, and indexing the result.

Query works, and returns data, but if I try to search
index=summary search_name="scheduled_search_name"

I get no data ?

Tags (2)

gkanapathy
Splunk Employee
Splunk Employee

Yes, if you've run your search as you've said, with summary indexing selected and a valid index selected to write to, then you should be okay. It is possible that

  • you don't have permissions to the index your wrote to, as you suggested
  • the index doesn't exist so the summary couldn't be saved
  • the summary is forwarded to a different indexer, and you're not set up to query that indexer (which is a complicated version of the permissions problem essentially)
  • there are deeper config issues, though those would be considered abnormal

sbsbb
Builder

Thank you so much for telling me I'm a dumb newbie, that helps a lot !

I think I can't see the logs because of user policy, we have a big shared system, so I don't have access to everything.

I've scheduled the search, (and I see it has been executed), and checked "Summary Indexing" "Enabled"
If I need something in my query for having this to work, it maybe what I'm missing....

0 Karma

Ayn
Legend

First of all, I don't see anything that shows you actually are writing events to a summary index in your search. You only say that you have a query that returns results.

Secondly, if you don't see ANY of the logs yannK is talking about you're in some serious trouble (or more likely, don't really know your way around Splunk, which can be understandable but is the real problem that should be addressed first before you dive into this more thoroughly)

0 Karma

sbsbb
Builder

I made a scheduled search, ending with | timechart span="1m" count by field1... The query returns results, but searching the index ist empty...

I can't see any of the logs specified in the first answer.

0 Karma

yannK
Splunk Employee
Splunk Employee

1 - verify that the scheduled search ran

index=_internal source=*scheduler.log

2 -check in for warnings about the spooler

index=_internal source=*splunkd.log "*spool*"

3- double check if your server is indexing locally or forwarding to another indexer

gkanapathy
Splunk Employee
Splunk Employee

You probably need to provide more information than this to get a helpful answer. For example, how are you "indexing the result"? Is there anything in the summary at all? etc.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...