# Buggy code
def run(self):
    """Entry point for the analyzer.

    Returns:
        String with summary of the analyzer result
    """
    query = (
        '{"query": { "bool": { "should": [ '
        '{ "exists" : { "field" : "url" }}, '
        '{ "exists" : { "field" : "domain" }} ] } } }'
    )

    return_fields = ["domain", "url"]

    events = self.event_stream("", query_dsl=query, return_fields=return_fields)

    domains = {}
    domain_counter = collections.Counter()
    tld_counter = collections.Counter()
    cdn_counter = collections.Counter()

    for event in events:
        domain = event.source.get("domain")

        if not domain:
            url = event.source.get("url")
            if not url:
                continue
            domain = utils.get_domain_from_url(url)

        if not domain:
            continue

        domain_counter[domain] += 1
        domains.setdefault(domain, [])
        domains[domain].append(event)

        tld = ".".join(domain.split(".")[-2:])
        tld_counter[tld] += 1

    domain_count_array = numpy.array(list(domain_counter.values()))
    domain_20th_percentile = int(numpy.percentile(domain_count_array, 20))
    domain_85th_percentile = int(numpy.percentile(domain_count_array, 85))

    common_domains = [
        x for x, y in domain_counter.most_common() if y >= domain_85th_percentile
    ]
    rare_domains = [
        x for x, y in domain_counter.most_common() if y <= domain_20th_percentile
    ]

    satellite_emoji = emojis.get_emoji("SATELLITE")
    for domain, count in iter(domain_counter.items()):
        emojis_to_add = [satellite_emoji]
        tags_to_add = []

        cdn_provider = utils.get_cdn_provider(domain)
        if cdn_provider:
            tags_to_add.append("known-cdn")
            cdn_counter[cdn_provider] += 1

        if domain in common_domains:
            tags_to_add.append("common_domain")

        if domain in rare_domains:
            tags_to_add.append("rare_domain")

        for event in domains.get(domain, []):
            event.add_tags(tags_to_add)
            event.add_emojis(emojis_to_add)

            new_attributes = {"domain": domain, "domain_count": count}
            if cdn_provider:
                new_attributes["cdn_provider"] = cdn_provider
            event.add_attributes(new_attributes)

            # Commit the event to the datastore.
            event.commit()

    return (
        "{0:d} domains discovered ({1:d} TLDs) and {2:d} known CDN networks found."
    ).format(len(domains), len(tld_counter), len(cdn_counter))


# Traceback (IndexError)
[2019-05-15 15:57:25,067: ERROR/ForkPoolWorker-1] Task timesketch.lib.tasks.run_sketch_analyzer[87c2fee5-d10c-4a92-8d28-a6acc970a7fe] raised unexpected: IndexError('cannot do a non-empty take from an empty axes.',)
Traceback (most recent call last):
File "/usr/local/lib/python3.6/dist-packages/celery/app/trace.py", line 385, in trace_task
R = retval = fun(*args, **kwargs)
File "/usr/local/lib/python3.6/dist-packages/timesketch-20190207-py3.6.egg/timesketch/__init__.py", line 181, in __call__
return TaskBase.__call__(self, *args, **kwargs)
File "/usr/local/lib/python3.6/dist-packages/celery/app/trace.py", line 648, in __protected_call__
return self.run(*args, **kwargs)
File "/usr/local/lib/python3.6/dist-packages/timesketch-20190207-py3.6.egg/timesketch/lib/tasks.py", line 334, in run_sketch_analyzer
result = analyzer.run_wrapper()
File "/usr/local/lib/python3.6/dist-packages/timesketch-20190207-py3.6.egg/timesketch/lib/analyzers/interface.py", line 37, in wrapper
func_return = func(self, *args, **kwargs)
File "/usr/local/lib/python3.6/dist-packages/timesketch-20190207-py3.6.egg/timesketch/lib/analyzers/interface.py", line 403, in run_wrapper
result = self.run()
File "/usr/local/lib/python3.6/dist-packages/timesketch-20190207-py3.6.egg/timesketch/lib/analyzers/domain.py", line 71, in run
domain_20th_percentile = int(numpy.percentile(domain_count_array, 20))
File "/usr/local/lib/python3.6/dist-packages/numpy/lib/function_base.py", line 3707, in percentile
a, q, axis, out, overwrite_input, interpolation, keepdims)
File "/usr/local/lib/python3.6/dist-packages/numpy/lib/function_base.py", line 3826, in _quantile_unchecked
interpolation=interpolation)
File "/usr/local/lib/python3.6/dist-packages/numpy/lib/function_base.py", line 3405, in _ureduce
r = func(a, **kwargs)
File "/usr/local/lib/python3.6/dist-packages/numpy/lib/function_base.py", line 3941, in _quantile_ureduce_func
x1 = take(ap, indices_below, axis=axis) * weights_below
File "/usr/local/lib/python3.6/dist-packages/numpy/core/fromnumeric.py", line 189, in take
return _wrapfunc(a, 'take', indices, axis=axis, out=out, mode=mode)
File "/usr/local/lib/python3.6/dist-packages/numpy/core/fromnumeric.py", line 56, in _wrapfunc
return getattr(obj, method)(*args, **kwds)
IndexError: cannot do a non-empty take from an empty axes.```

Should I add something here https://github.com/google/timesketch/blob/7244f821b9c257d42402115f6a39cab266f0a84c/timesketch/lib/analyzers/domain.py#L70
in order to set at 0 for example in case domain_count_array returns empty?

# Fixed code
def run(self):
    """Entry point for the analyzer.

    Returns:
        String with summary of the analyzer result
    """
    query = (
        '{"query": { "bool": { "should": [ '
        '{ "exists" : { "field" : "url" }}, '
        '{ "exists" : { "field" : "domain" }} ] } } }'
    )

    return_fields = ["domain", "url"]

    events = self.event_stream("", query_dsl=query, return_fields=return_fields)

    domains = {}
    domain_counter = collections.Counter()
    tld_counter = collections.Counter()
    cdn_counter = collections.Counter()

    for event in events:
        domain = event.source.get("domain")

        if not domain:
            url = event.source.get("url")
            if not url:
                continue
            domain = utils.get_domain_from_url(url)

        if not domain:
            continue

        domain_counter[domain] += 1
        domains.setdefault(domain, [])
        domains[domain].append(event)

        tld = ".".join(domain.split(".")[-2:])
        tld_counter[tld] += 1

    # Exit early if there are no domains in the data set to analyze.
    if not domain_counter:
        return "No domains to analyze."

    domain_count_array = numpy.array(list(domain_counter.values()))
    domain_20th_percentile = int(numpy.percentile(domain_count_array, 20))
    domain_85th_percentile = int(numpy.percentile(domain_count_array, 85))

    common_domains = [
        x for x, y in domain_counter.most_common() if y >= domain_85th_percentile
    ]
    rare_domains = [
        x for x, y in domain_counter.most_common() if y <= domain_20th_percentile
    ]

    satellite_emoji = emojis.get_emoji("SATELLITE")
    for domain, count in iter(domain_counter.items()):
        emojis_to_add = [satellite_emoji]
        tags_to_add = []

        cdn_provider = utils.get_cdn_provider(domain)
        if cdn_provider:
            tags_to_add.append("known-cdn")
            cdn_counter[cdn_provider] += 1

        if domain in common_domains:
            tags_to_add.append("common_domain")

        if domain in rare_domains:
            tags_to_add.append("rare_domain")

        for event in domains.get(domain, []):
            event.add_tags(tags_to_add)
            event.add_emojis(emojis_to_add)

            new_attributes = {"domain": domain, "domain_count": count}
            if cdn_provider:
                new_attributes["cdn_provider"] = cdn_provider
            event.add_attributes(new_attributes)

            # Commit the event to the datastore.
            event.commit()

    return (
        "{0:d} domains discovered ({1:d} TLDs) and {2:d} known CDN networks found."
    ).format(len(domains), len(tld_counter), len(cdn_counter))