Knowledge Management

6.6.x summary indexing: Where'd it go? Where'd the indexes go?

twinspop
Influencer

In the re-write of the searches and reports interface, they've moved summary indexing to its own menu item under Edit.

Something else has changed though. The dropdown list for which summary index to use has been truncated. How do I control this? In 6.5.3 it listed all my indexes, about 150. It now has 3 or 4. I've yet to figure out why these get listed.

0 Karma
1 Solution

twinspop
Influencer

Confirmed. As of 6.6 the SHC app bundle should include indexes.conf that lists all available summary indexes.

View solution in original post

0 Karma

twinspop
Influencer

Confirmed. As of 6.6 the SHC app bundle should include indexes.conf that lists all available summary indexes.

0 Karma

twinspop
Influencer

and in 7.0.3 (coming from 6.6.3) this has broken. Sumbitch.

twinspop
Influencer

It looks like you have to explicitly define all potential summary indexes on the SHC.

0 Karma
Get Updates on the Splunk Community!

Unleash Unified Security and Observability with Splunk Cloud Platform

     Now Available on Microsoft AzureThursday, March 27, 2025  |  11AM PST / 2PM EST | Register NowStep boldly ...

Splunk AppDynamics with Cisco Secure Application

Web applications unfortunately present a target rich environment for security vulnerabilities and attacks. ...

New Splunk Innovations Enhance Performance and Accelerate Troubleshooting

Splunk is excited to announce new releases that empower ITOps and engineering teams to stay ahead in ever ...