There are plenty of matching events, but why are summary index results not generated?

[billycote]

Hi Folks,

I have the following search:

index=snaptor sourcetype=IDCResponseTimes requestoption!=*PercentBarDataRequestOption* (Connection_Type=HistTick OR Connection_Type=HistBar) | fields Connection_Type Status Number_of_bars Response_Time | eval Num_bars = case(Status =="NO_DATA",0, Status !="NO_DATA",Number_of_bars) | eval bar_type = case(Connection_Type=="HistTick", "intraday", Connection_Type=="HistBar", "end-of-day") | eval response_size = case(bar_type=="intraday", case(Num_bars <= 600, "small", Num_bars <= 1500, "medium", Num_bars <= 2500, "large", Num_bars > 2500, "excessive!"), bar_type=="end-of-day", case(Num_bars <= 900, "small", Num_bars <= 2000, "medium", Num_bars <= 2500, "large", Num_bars > 2500, "excessive!")) | bin _time span=1d | stats count as request_count, avg(Response_Time) as resptime_avg, exactperc99(Response_Time) AS resptime_p99, exactperc99.9(Response_Time) AS resptime_p999, exactperc99.99(Response_Time) as resptime_p9999, max(Response_Time) AS resptime_max by _time bar_type, response_size | eval resptime_avg=round(resptime_avg,1)

This works fine when I run it on the search line. However, when I try to put it into a summary index, no results are generated. I looked at the job with the inspector and I see this:

This search has completed and found 8,502,740 matching events. However, the transforming commands in the highlighted portion of the following search: 

| stats count as request_count, avg(Response_Time) as resptime_avg, exactperc99(Response_Time) AS resptime_p99, exactperc99.9(Response_Time) AS resptime_p999, exactperc99.99(Response_Time) as resptime_p9999, max(Response_Time) AS resptime_max by _time bar_type, response_size | eval resptime_avg=round(resptime_avg,1) | summaryindex spool=t uselb=t addtime=t index="si_idcsla" file="RMD5ef94608677008700_1443652997.stash_new" name="IdcSla_RespTime_Prod" marker="report=\"ResponseTime\""

 over the time range:

4/5/16 7:00:00.000 AM – 4/5/16 8:00:00.000 PM

generated no results. Possible solutions are to:

    check the syntax of the commands
    verify that the fields expected by the report commands are present in the events

I've checked the syntax and it's working just fine, but not generating results to the summary index.

Any idea?

[billycote]

I saved the exact same query into a different report and it started writing to a summary index. I'm very confused why I had to do this.

[somesoni2]

Give this a try (changed fields to table and added _time)

 index=snaptor sourcetype=IDCResponseTimes requestoption!=*PercentBarDataRequestOption* (Connection_Type=HistTick OR Connection_Type=HistBar) | table _time Connection_Type Status Number_of_bars Response_Time | eval Num_bars = case(Status =="NO_DATA",0, Status !="NO_DATA",Number_of_bars) | eval bar_type = case(Connection_Type=="HistTick", "intraday", Connection_Type=="HistBar", "end-of-day") | eval response_size = case(bar_type=="intraday", case(Num_bars <= 600, "small", Num_bars <= 1500, "medium", Num_bars <= 2500, "large", Num_bars > 2500, "excessive!"), bar_type=="end-of-day", case(Num_bars <= 900, "small", Num_bars <= 2000, "medium", Num_bars <= 2500, "large", Num_bars > 2500, "excessive!")) | bin _time span=1d | stats count as request_count, avg(Response_Time) as resptime_avg, exactperc99(Response_Time) AS resptime_p99, exactperc99.9(Response_Time) AS resptime_p999, exactperc99.99(Response_Time) as resptime_p9999, max(Response_Time) AS resptime_max by _time bar_type, response_size | eval resptime_avg=round(resptime_avg,1)