The following search is used in a saved search that will fill a summary index :
| tstats count as requests, sum(sc_bytes) as sc_bytes where index="cdn_main" by _time span=1d, host, sc_status | lookup http_status_codes status AS sc_status OUTPUTNEW status_type, status_ok
Running this manually works. However when this is run as part of a schedule the value "None" is prefixed to the search. This can be seen when selecting 'View recent' in 'Searches and reports'. Inspecting a job shows the following error message :
This search has completed, but did not match any events. The terms specified in the highlighted portion of the search: None | tstats count as requests, sum(sc_bytes) as sc_bytes where index="cdn_main" by _time span=1d, host, sc_status | lookup http_status_codes status AS sc_status OUTPUTNEW status_type, status_ok | summaryindex spool=t uselb=t addtime=t index="cdn_summary" file="RMD5ef2fc74d606e5ef5_2109984147.stash_new" name="Daily Summary Search" marker=""
None is highlighted in yellow.
This search is run on a cluster master. The cluster master has a tcpout stanza in outputs.conf configuration that specifies that the queries should send the output to the indexers.
Any idea what is going on here ?
Thanks in advance
The search job inspector also says this :
The following messages were returned by the search subsystem:
INFO: No results to summary index.
ERROR: [si hostname] Search process did not exit cleanly, exitcode=255, description="exited with code 255". Please look in search.log for this peer in the Job Inspector for more info.
DEBUG: search context: user="admin", app="cdnreporting", bs-pathname="/opt/splunk/etc"
I changed the hostname to 'si hostname'.
This seems to be a bug in Splunk : the None is added only when no data is selected by the saved search.