topic Re: Why does my summary search not produce any results? in Splunk Search

Why does my summary search not produce any results?

andreac81 — Mon, 22 May 2017 10:43:42 GMT

Hi to all,

I have a summary search that doesn't produce results, if I copy and paste the same search in "search & reporting" app, I can see the results.
I noticed that this search is slow, results appears after quite a minute, is it possible that launching the search in summary search it goes in timeout? Or there is another reason for which summary search doesn't produce results?

Thanks,
Andrea

Re: Why does my summary search not produce any results?

adonio — Mon, 22 May 2017 14:00:32 GMT

can you search for errors about this search in index = _internal.
you can see if it timed out or fails

Re: Why does my summary search not produce any results?

andreac81 — Mon, 22 May 2017 14:42:47 GMT

05-22-2017 16:16:36.732 +0200 INFO  SavedSplunker - savedsearch_id="nobody;app1;summary_search1", user="nobody", app="app1", savedsearch_name="summary_search1", status=success, digest_mode=1, scheduled_time=1495462560, window_time=300, dispatch_time=1495462594, run_time=1.800, result_count=0, alert_actions="summary_index", sid="scheduler__nobody_YWFhbS1hdnNtNS11aQ__RMD54cf5f9fca85694aa_at_1495462560_7849", suppressed=0, thread_id="AlertNotifierWorker-0"

It seems to succed but returns result_count=0

Re: Why does my summary search not produce any results?

DalJeanis — Mon, 22 May 2017 15:43:50 GMT

It is possible. If you post the search language, minus any confidential information, then we can see if there is any way to make it more efficient.

Re: Why does my summary search not produce any results?

woodcock — Sat, 27 May 2017 16:56:51 GMT

There is nothing special about a summary index search so let's cover the basics. Probably you are running the search as either a different user or in a different app context between your 2 runs. You know the user that you are using for your test and you are saying (but may not really mean it) that you are searching from within the app context of search ("Search and Reporting"). So run this search and verify that the user is the same and the app is search. If not, fix that and then it should work:

|rest/services/search/jobs | table author eai:acl.owner sid title eai:acl.app dispatchState resultCount runDuration eventSearch

Also, how are you determining that it "doesn't produce results"? The above search will show resultCount which you are saying is 0 but is it? How do you know it is not working?