Summary index doesn't seem to work with count(eval(...))

[spock_yh]

I have the following search populating a summary index:

index="client_tracking" tag::eventtype=normal_user tracking_phase=20110420_A | sistats count(eval(ss_action="click.button")) AS "clicks"

It populates fine and if I just extract all events from the summary index I see a field called psrsvd_ct_eval(ss_action="click.button") with value 98 for example.

However, when I execute:

index="summary" source="test_search" | stats count(eval(ss_action="click.button")) AS "clicks"

I get 0. Note that if I use simpler fields everything works as expected. For example, just "count", or range(_time), works fine.

Does anyone know if splunk has a problem with sistats and eval-ed expressions in the aggregating function?

[dwaddle]

Others have reported similar problems. It might be a bug, or it might be a limitation of how sistats and stats work together. Your best approach is to simplify your first stats operation that is working with the summary index data and do any additional computation / analysis / filtering later in the search pipeline.

I would recommend opening a support case. Splunk Support / Engineering are in the best position to determine if this is a bug or a limitation of the current summary index system.

In the meanwhile, you can probably perform a workaround similar to this:

index="client_tracking" tag::eventtype=normal_user tracking_phase=20110420_A 
| sistats count by ss_action

For your populating search, and

index="summary" source="test_search" 
| stats count by ss_action | search ss_action="click.button"

[dwaddle]

Understood. There is a more complex (but not as complex as yours) example at http://splunk-base.splunk.com/answers/31207/eval-limitations-on-si-index-with-sistats-count-by-field...

[spock_yh]

Actually my real stats is a lot more complex and includes several aggregation functions and a by clause, so I don't think this approach would work.
But perhaps computing an "eval" field prior to sistats and only using count(fieldname) will be ok. I'll check and post back.