The correct way to search against the summary index for this data is:
index=summary search_name="Linux logins" | stats count by src_ip user
Here’s why this works:
Summary Index: Summary indexes store pre-aggregated data generated by scheduled reports or saved searches. To query this data, you must specify theindex=summaryand filter by thesearch_namefield, which identifies the specific report that populated the summary index.
Aggregation: The original search usedsitop, which is designed for summary indexing. When querying the summary index, you should usestatsto aggregate the pre-aggregated data further.
Example:
index=summary search_name="Linux logins"
| stats count by src_ip user
[References:, Splunk Documentation on Summary Indexing:https://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Usesummaryindexing, Splunk Documentation onsitop:https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/sitop, , ]
Submit