In general, summary index generating searches need to use a transforming/reporting command such as timechart, stats, chart, etc.
So, you could change your search to be something like:
source="/home/splunk/foo.log" oútcome=* | stats count(eval(outcome="FAILURE")) as failures count(eval(outcome="SUCCESS")) as successes
Then, your search against the summary index becomes something like:
index=summary source="index-populating-query" | timechart span=5m sum(successes) as successes sum(failures) as failures | fillnull value=0
And would yield a result like:
_time successes failures
12/05/11 00:00:00 4 0
12/05/11 00:05:00 7 1
12/05/11 00:10:00 6 3
... View more