Why does my summary search not produce any results?

[andreac81]

Hi to all,

I have a summary search that doesn't produce results, if I copy and paste the same search in "search & reporting" app, I can see the results.
I noticed that this search is slow, results appears after quite a minute, is it possible that launching the search in summary search it goes in timeout? Or there is another reason for which summary search doesn't produce results?

Thanks,
Andrea

[woodcock]

There is nothing special about a summary index search so let's cover the basics. Probably you are running the search as either a different user or in a different app context between your 2 runs. You know the user that you are using for your test and you are saying (but may not really mean it) that you are searching from within the app context of search ("Search and Reporting"). So run this search and verify that the user is the same and the app is search. If not, fix that and then it should work:

|rest/services/search/jobs | table author eai:acl.owner sid title eai:acl.app dispatchState resultCount runDuration eventSearch

Also, how are you determining that it "doesn't produce results"? The above search will show resultCount which you are saying is 0 but is it? How do you know it is not working?

[DalJeanis]

It is possible. If you post the search language, minus any confidential information, then we can see if there is any way to make it more efficient.

[andreac81]

05-22-2017 16:16:36.732 +0200 INFO  SavedSplunker - savedsearch_id="nobody;app1;summary_search1", user="nobody", app="app1", savedsearch_name="summary_search1", status=success, digest_mode=1, scheduled_time=1495462560, window_time=300, dispatch_time=1495462594, run_time=1.800, result_count=0, alert_actions="summary_index", sid="scheduler__nobody_YWFhbS1hdnNtNS11aQ__RMD54cf5f9fca85694aa_at_1495462560_7849", suppressed=0, thread_id="AlertNotifierWorker-0"

It seems to succed but returns result_count=0

[adonio]

can you search for errors about this search in index = _internal.
you can see if it timed out or fails