Why is my summary index search timechart not displaying?

[tkwaller]

We have a summary index called summary_site_stats,

One of the saved searches that adds data to that summary index is named:
summary - count by status not 2xx:

count=* and status=*

This search has 2 fields in it
06/16/2016 16:58:00 +0000, search_name="summary - count by status not 2xx", search_now=1466099880.000, info_min_time=1466096280.000, info_max_time=1466099880.000, info_search_time=1466099884.303, count=448, status=504

Using this search I am able to create a timechart of the values:

index=summary_site_stats search_name="summary - count by status not 2xx" status=* | rename count as mycount | timechart values(mycount) by status useother=f

it works if I run it over a 2 hour span, but if I run it for anything more, such as 7 days or 30 days the timechart is blank.

[somesoni2 · Accepted solution]

Strange. Could you try running this for longer period (start with last 4 Hr/Last 24 Hr)

index=summary_site_stats source="summary - count by status not 2xx" status=* | timechart sum(count) by status useother=f

The values function gives multivalued field (if applicable) and seems like for longer period, the span gets higher too and you get multivalued fields in your result thus you can't chart them.

Try seeing result in table format for your current search to confirm that.

[tkwaller]

Yep that DID work and you are also correct. The multivalued fields were very large.

[sundareshr]

Was the summary index populated with data >2 hours?

https://wiki.splunk.com/Community:Summary_Indexing_Back_Fill

[tkwaller]

Search runs hourly. If I run it in verbose mode I can see the daily logs. Running the above search and clicking on the Statistics tab I can see the table with all the information, it just wont display in the timechart for anything over 24 hours.