Hi to all,
I have a summary search that doesn't produce results, if I copy and paste the same search in "search & reporting" app, I can see the results.
I noticed that this search is slow, results appears after quite a minute, is it possible that launching the search in summary search it goes in timeout? Or there is another reason for which summary search doesn't produce results?
Thanks,
Andrea
There is nothing special about a summary index search so let's cover the basics. Probably you are running the search as either a different user
or in a different app
context between your 2 runs. You know the user
that you are using for your test and you are saying (but may not really mean it) that you are searching from within the app
context of search
("Search and Reporting"). So run this search and verify that the user
is the same and the app
is search
. If not, fix that and then it should work:
|rest/services/search/jobs | table author eai:acl.owner sid title eai:acl.app dispatchState resultCount runDuration eventSearch
Also, how are you determining that it "doesn't produce results"? The above search will show resultCount
which you are saying is 0
but is it? How do you know it is not working?
It is possible. If you post the search language, minus any confidential information, then we can see if there is any way to make it more efficient.
05-22-2017 16:16:36.732 +0200 INFO SavedSplunker - savedsearch_id="nobody;app1;summary_search1", user="nobody", app="app1", savedsearch_name="summary_search1", status=success, digest_mode=1, scheduled_time=1495462560, window_time=300, dispatch_time=1495462594, run_time=1.800, result_count=0, alert_actions="summary_index", sid="scheduler__nobody_YWFhbS1hdnNtNS11aQ__RMD54cf5f9fca85694aa_at_1495462560_7849", suppressed=0, thread_id="AlertNotifierWorker-0"
It seems to succed but returns result_count=0
can you search for errors about this search in index = _internal.
you can see if it timed out or fails