Knowledge Management

Summary index not being populated until saved search name is changed. [RESOLVED]

jamesaarondevli
Path Finder

Hi all,

I have created a saved search which populates a summary index. I am testing this saved search and need to be able to clean the index, re-run the saved search and review the results.

The problem I am having is that I can run the saved search once and verify the summary index has results, but subsequent runs return events in the Job page without actually placing those results into the summary index.

The fix I have identified is to clone and rename the saved search. But once again, after I've used this saved search once I can no longer re-use it until I clone and rename it.

I appreciate any help.

Regards,
James

Tags (3)
0 Karma
1 Solution

hazekamp
Builder

James,

I believe this is being caused by a known issue in 4.2.0/4.2.1 where a saved search loses it's schedule when edited via manager. Renaming the search is fixing your problem because it invalidates the local.meta causing the issue.

See also:
http://splunk-base.splunk.com/answers/22875/splunk-v422-fixes

View solution in original post

hazekamp
Builder

James,

I believe this is being caused by a known issue in 4.2.0/4.2.1 where a saved search loses it's schedule when edited via manager. Renaming the search is fixing your problem because it invalidates the local.meta causing the issue.

See also:
http://splunk-base.splunk.com/answers/22875/splunk-v422-fixes

hazekamp
Builder

FYI; This is resolved in 4.2.2 per release note "Scheduled saved search loses scheduled time when converted from private to global permissions (All apps). Scheduled time resets to None. (SPL-38616)"

0 Karma
Get Updates on the Splunk Community!

Join Us for Splunk University and Get Your Bootcamp Game On!

If you know, you know! Splunk University is the vibe this summer so register today for bootcamps galore ...

.conf24 | Learning Tracks for Security, Observability, Platform, and Developers!

.conf24 is taking place at The Venetian in Las Vegas from June 11 - 14. Continue reading to learn about the ...

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...