Extra 'None' in saved search when populating summary index

[mountainbike]

Hello,

The following search is used in a saved search that will fill a summary index :

| tstats count as requests, sum(sc_bytes) as sc_bytes where index="cdn_main" by _time span=1d, host, sc_status | lookup http_status_codes status AS sc_status OUTPUTNEW status_type, status_ok

Running this manually works. However when this is run as part of a schedule the value "None" is prefixed to the search. This can be seen when selecting 'View recent' in 'Searches and reports'. Inspecting a job shows the following error message :

This search has completed, but did not match any events. The terms specified in the highlighted portion of the search:

None | tstats count as requests, sum(sc_bytes) as sc_bytes where index="cdn_main" by _time span=1d, host, sc_status | lookup http_status_codes status AS sc_status OUTPUTNEW status_type, status_ok | summaryindex spool=t uselb=t addtime=t index="cdn_summary" file="RMD5ef2fc74d606e5ef5_2109984147.stash_new" name="Daily Summary Search" marker=""

None is highlighted in yellow.

This search is run on a cluster master. The cluster master has a tcpout stanza in outputs.conf configuration that specifies that the queries should send the output to the indexers.

Any idea what is going on here ?

Thanks in advance

[mountainbike · Accepted solution]

This seems to be a bug in Splunk : the None is added only when no data is selected by the saved search.

[mountainbike]

The search job inspector also says this :

The following messages were returned by the search subsystem:

INFO: No results to summary index.
ERROR: [si hostname] Search process did not exit cleanly, exit_code=255, description="exited with code 255". Please look in search.log for this peer in the Job Inspector for more info.
DEBUG: search context: user="admin", app="cdn_reporting", bs-pathname="/opt/splunk/etc"

I changed the hostname to 'si hostname'.

[mountainbike]

I'm using Splunk 6.0-182037 on Linux.