Knowledge Management

Summary index not being populated until saved search name is changed. [RESOLVED]

jamesaarondevli
Path Finder

Hi all,

I have created a saved search which populates a summary index. I am testing this saved search and need to be able to clean the index, re-run the saved search and review the results.

The problem I am having is that I can run the saved search once and verify the summary index has results, but subsequent runs return events in the Job page without actually placing those results into the summary index.

The fix I have identified is to clone and rename the saved search. But once again, after I've used this saved search once I can no longer re-use it until I clone and rename it.

I appreciate any help.

Regards,
James

Tags (3)
0 Karma
1 Solution

hazekamp
Builder

James,

I believe this is being caused by a known issue in 4.2.0/4.2.1 where a saved search loses it's schedule when edited via manager. Renaming the search is fixing your problem because it invalidates the local.meta causing the issue.

See also:
http://splunk-base.splunk.com/answers/22875/splunk-v422-fixes

View solution in original post

hazekamp
Builder

James,

I believe this is being caused by a known issue in 4.2.0/4.2.1 where a saved search loses it's schedule when edited via manager. Renaming the search is fixing your problem because it invalidates the local.meta causing the issue.

See also:
http://splunk-base.splunk.com/answers/22875/splunk-v422-fixes

hazekamp
Builder

FYI; This is resolved in 4.2.2 per release note "Scheduled saved search loses scheduled time when converted from private to global permissions (All apps). Scheduled time resets to None. (SPL-38616)"

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...