Summary indexing with join

[splunkreal]

Hello guys,

I'm using index=... | join commonfield [search index=...] | sistats count as nb

scheduled each minute on low number of results, nothing is written in summary index, unlike other queries without join.

Is it correct syntax or maybe summary indexing is 'missing' data as it's scheduled too frequently?

No error in scheduler.log

Thanks.

[richgalloway]

Try using stats instead of sistats.  The si* commands rarely are needed.

If it still doesn't work, remove the stats command and verify the join is producing the expected results.

[splunkreal]

Hi,

sistats is required in order to use summary indexing, isn't it?

Results are produced using stats.

Thanks for your help.

[richgalloway]

sistats is not required for summary indexing, although the manual does not make that clear.

[splunkreal · Accepted solution]

I tried again with sistats with larger period @d to @h it works so I suspect each minute is missing data with -1m@m to @m

[richgalloway]

If your problem is resolved, then please click the "Accept as Solution" button to help future readers.