Splunk Search

Can you help me with summary index field issue?

chinmayc469
Explorer

Hello,

I have created a scheduled search which populates a summary index from a custom index.

My main custom index has around 100 fields, but those fields are not appearing in the summary index. Only host and source source type fields are present in the summary index.

When i tried adding table field1, field2, etc in the scheduled search query, then those mentioned fields were appearing in the summary index. But when i use table * in the search query, i am not getting any fields in the summary index.

Currently, I have to explicitly specify "table field names" in the query, which is tedious considering the number of fields.

IS there any way to fix this issue?

0 Karma

landen99
Motivator

In the first place, you should be creating summary data for the summary index. Re-indexing a shorter version of all or even a filtered subset is extremely redundant, unnecessary and not the purpose of a summary index.
All that said, | table * includes many metadata fields that should not be included in a summary index including all the "_" fields. Given that you have said the number of fields is quite large, it is hard to imagine a case where such belongs in a summary index. But if you must, you may want to try adding a | fields - _* to remove the underscore fields and a few others like sourcetype, host, source, index, etc.
Also, ensure that your search head is forwarding to the IDX tier so that you take advantage of the parallelization. Also, make sure that you are using collect instead of tscollect.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...