There seems to be an issue with the field extraction for the userName. Try setting the 6th line to :
| spath output=userName path=userIdentity.sessionContext.sessionIssuer.userName
The search should complete with the count and errors tables populating. Here is the complete search, I took out the last 'search' since I'm not running it within the context of the search filters on the dashboard:
(index="main" OR (index="main" OR index="default") OR index="default") sourcetype="aws:cloudtrail"
| lookup all_eventName eventName OUTPUTNEW function
| search function="S3 Data Event"
| spath output=bucketName path="requestParameters.bucketName"
| spath output=objectName path=requestParameters.key
| spath output=userName path=userIdentity.sessionContext.sessionIssuer.userName
| eval error=if(errorCode=="success",0, 1)
| lookup unauthorized_errorCode errorCode OUTPUT Unauthorized
| eval Unauthorized=if(Unauthorized=="true", 1, 0)
| stats count by region, aws_account_id, bucketName, objectName, userName, userAgent, sourceIPAddress,Unauthorized, error, readOnly, _time
| stats sum(count) as count sum(error) as errors
| nadefault errors count
| eval _total_name="Data Events", _total_field=count
... View more