Splunk Search

Why am I unable to find a summary index in search when using index=summary?

ashishlal82
Explorer

I have a saved search in the default summary index and when I use the index=summary in my search box, I cannot find the summary index? Not sure why?

Tags (2)
0 Karma

lguinn2
Legend

Your Splunk role must have permissions to access the summary index.
Also, similar to @somesoni2 - is there any data in the summary index? How do you know your populating search is working?

0 Karma

somesoni2
Revered Legend

So you have a scheduled search with alert action as summary indexing and it's sending data to index=summary? Is the search scheduled and have results? Did you select appropriate time-range while running your query to see the summary index data?

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...