Hello guys,
I'm using index=... | join commonfield [search index=...] | sistats count as nb
scheduled each minute on low number of results, nothing is written in summary index, unlike other queries without join.
Is it correct syntax or maybe summary indexing is 'missing' data as it's scheduled too frequently?
No error in scheduler.log
Thanks.
I tried again with sistats with larger period @d to @h it works so I suspect each minute is missing data with -1m@m to @m
Try using stats instead of sistats. The si* commands rarely are needed.
If it still doesn't work, remove the stats command and verify the join is producing the expected results.
Hi,
sistats is required in order to use summary indexing, isn't it?
Results are produced using stats.
Thanks for your help.
sistats is not required for summary indexing, although the manual does not make that clear.
I tried again with sistats with larger period @d to @h it works so I suspect each minute is missing data with -1m@m to @m