Splunk Search

Why am I unable to find a summary index in search when using index=summary?

ashishlal82
Explorer

I have a saved search in the default summary index and when I use the index=summary in my search box, I cannot find the summary index? Not sure why?

Tags (2)
0 Karma

lguinn2
Legend

Your Splunk role must have permissions to access the summary index.
Also, similar to @somesoni2 - is there any data in the summary index? How do you know your populating search is working?

0 Karma

somesoni2
Revered Legend

So you have a scheduled search with alert action as summary indexing and it's sending data to index=summary? Is the search scheduled and have results? Did you select appropriate time-range while running your query to see the summary index data?

0 Karma
Get Updates on the Splunk Community!

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...

Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting

For Splunk Cloud customers, understanding and optimizing Splunk Virtual Compute (SVC) usage and resource ...

Automatic Discovery Part 3: Practical Use Cases

If you’ve enabled Automatic Discovery in your install of the Splunk Distribution of the OpenTelemetry ...