Can you help me with summary index field issue?

[chinmayc469]

Hello,

I have created a scheduled search which populates a summary index from a custom index.

My main custom index has around 100 fields, but those fields are not appearing in the summary index. Only host and source source type fields are present in the summary index.

When i tried adding table field1, field2, etc in the scheduled search query, then those mentioned fields were appearing in the summary index. But when i use table * in the search query, i am not getting any fields in the summary index.

Currently, I have to explicitly specify "table field names" in the query, which is tedious considering the number of fields.

IS there any way to fix this issue?

[landen99]

In the first place, you should be creating summary data for the summary index. Re-indexing a shorter version of all or even a filtered subset is extremely redundant, unnecessary and not the purpose of a summary index.
All that said, | table * includes many metadata fields that should not be included in a summary index including all the "_" fields. Given that you have said the number of fields is quite large, it is hard to imagine a case where such belongs in a summary index. But if you must, you may want to try adding a | fields - _* to remove the underscore fields and a few others like sourcetype, host, source, index, etc.
Also, ensure that your search head is forwarding to the IDX tier so that you take advantage of the parallelization. Also, make sure that you are using collect instead of tscollect.