Monitoring Splunk

summary index not showing any events

prasireddy
Explorer

hi team,
I wanted to create summary index using the following query.

Daily Request counts Last Month

 

index=service_audit REQUEST
| bucket span=d _time
| eval time_diff=round(((stopDate - startDate)/3600000),0)
| stats count as Request_Count by _time

 

 
1.I followed all the steps mentioned in the splunk.com 
2.i have created new summary index as name service_audit_summary 

prasireddy_2-1724775622090.png

3.using collect command 

 

index=service_audit REQUEST
| bucket span=d _time
| eval time_diff=round(((stopDate - startDate)/3600000),0)
| stats count as Request_Count by _time
| collect index=service_audit_summary 

 

but the summary index not showing any event ?

prasireddy_0-1724775453498.png

 

prasireddy_1-1724775512077.png

 

4.even created report and tried but same problem I'm facing 
please anyone could suggest 


Thanks in advance 

Labels (2)
0 Karma

PaulPanther
Motivator

@prasireddy Sorry was on vacation the last two weeks. Are you still facing the issue?

0 Karma

PaulPanther
Motivator

Please execute your original search without testmode=true and after the execution please click on Job --> Inspect Job.

Check if you see any error message in the popup.

 

PaulPanther_0-1724926253677.png

 

0 Karma

prasireddy
Explorer

hi @PaulPanther 

This is the screen shot of Job --> Inspect Job. Please I need help on this asap.

prasireddy_0-1725370746251.png

 

0 Karma

PaulPanther
Motivator

Please set testmode=true in your collect command and please post the outcome. 

0 Karma

prasireddy
Explorer

 

Hi @PaulPanther this is screen shot after adding testmode=true

prasireddy_0-1724849048921.png

 

0 Karma

PaulPanther
Motivator

Okay, looks good. Could you please search in the summary index over all time? And please ensure you have access to the summary index.

0 Karma

prasireddy
Explorer



Hi @PaulPanther Still same I'm Facing Issue

prasireddy_0-1724855283286.png

How can check weather I have access to the summary index. could you please help me.

0 Karma

prasireddy
Explorer

Hi @PaulPanther
I believe I have access

 

prasireddy_0-1724855949193.png

 

0 Karma
Get Updates on the Splunk Community!

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Your Voice Matters! Help Us Shape the New Splunk Lantern Experience

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Building Momentum: Splunk Developer Program at .conf25

At Splunk, developers are at the heart of innovation. That’s why this year at .conf25, we officially launched ...