Actually a little more searching and I found the answer here (https://community.splunk.com/t5/Knowledge-Management/How-to-fix-misleading-quot-What-to-search-quot-...). I also on my experimental/learning box (latest version) had enabled (under Settings -> Roles -> Admin -> Indexes) the * (All non-internal indexes) and the _* (All internal indexes) to be default and this immediately allowed data summary to work and see all the indexes. I can see how, by default, you might not want to have this enabled for the admin account.
I think in courses you do, they may enable this by default for your accounts on non-internal indexes to make it easier for you to configure things, so I had not had to configure it myself.
Good Day. I was curious if you had ever found an answer here. I noticed the same thing, logged in about 3 days later, and the data had been populated (but not for the data I had put in the day before. I assume there is a search that populates this data, but it only runs maybe 1/x per day or week.
