Reporting

Summary Index

VijaySrrie
Builder

Hi,

I have a scheduled search where summary indexing is enabled

I also have a summary index created.

The output of the scheduled search is not send to summary index.

summar index = "test_summary"

Scheduled search name -  test_summary_report 

summary indexing is enabled

vijaysri_0-1616049927980.png

Cron schedule is set to run every minute.

 

What would be the issue?

 

 

0 Karma

VijaySrrie
Builder

@manjunathmeti  you can see the query has run and we are getting the results, and the results from the query is sent to the index, but when i search the index=test_summary, no results are seen.

vijaysri_0-1616127950790.png

vijaysri_1-1616128004450.png

 

0 Karma

manjunathmeti
SplunkTrust
SplunkTrust

hi @VijaySrrie,
1. Check the time period for the scheduled search test_summary_report and see if the search produces any results in that time period. You can check the event count for the scheduled search on the Activity >> Jobs page.

2. If you are getting results in the time period then use the collect command to push the search results to the summary index.

saved_search_query | collect index=test_summary sourcetype=test

 

If this reply helps you, an upvote/like would be appreciated.

 

0 Karma

VijaySrrie
Builder

@manjunathmeti  when I opened the scheduled search I could see the results

Scheduled search Query - | inputlookup lookup.csv

I tried the below query

 

saved_search_query | collect index=test_summary sourcetype=test

| inputlookup lookup.csv | collect index=test_summary  (This is not working) --> When I searched the index=test_summary (Time range: All time) - I was not getting any results

0 Karma

manjunathmeti
SplunkTrust
SplunkTrust

Check if the user has access to index test_summary.

0 Karma

VijaySrrie
Builder

@manjunathmeti  I am the user who created the Index, I have admin access

0 Karma

manjunathmeti
SplunkTrust
SplunkTrust

Try summarizing in another index:

| inputlookup noc | summaryindex index=main sourcetype=test
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...