topic Re: ./splunk cmd python fill_summary_index.py -app splunkdotcom -name "*" -et -mon@mon -lt @mon -dedup true -auth admin:changeme in Deployment Architecture

./splunk cmd python fill_summary_index.py -app splunkdotcom -name "*" -et -mon@mon -lt @mon -dedup true -auth admin:changeme

Prakash493 — Fri, 19 Apr 2019 21:18:38 GMT

Hi , Currently we have infrastructure with one search head deployer , one indexer cluster , one deployment server with 3 sh , 6 idx. we are trying to backfill the data through summary indexing , when i check the splunk docs i found a command ./splunk cmd python fill_summary_index.py -app splunkdotcom -name "*" -et -mon@mon -lt @mon -dedup true -auth admin:changeme, but confused on which location i have to execute this command as we have a indexer cluster in one server and search head deployer in one server , if in indexer cluster master , on which location simply in bin folder or do i need to go to the app name and inside the app their is bin folder , their ? after executing in indexer cluster master is it pull the changes to search head ? or do i need to execute it on sh deployer too.

Please help me

Re: ./splunk cmd python fill_summary_index.py -app splunkdotcom -name "*" -et -mon@mon -lt @mon -dedup true -auth admin:changeme

woodcock — Sat, 20 Apr 2019 02:07:31 GMT

The summary index backfill script must be run on any Search Head.

Re: ./splunk cmd python fill_summary_index.py -app splunkdotcom -name "*" -et -mon@mon -lt @mon -dedup true -auth admin:changeme

Prakash493 — Sat, 20 Apr 2019 16:42:47 GMT

But my search heads are clustered and have one search head deployer that I use to deploy apps , so you mean just I run this command only on any one search head right ?

Re: ./splunk cmd python fill_summary_index.py -app splunkdotcom -name "*" -et -mon@mon -lt @mon -dedup true -auth admin:changeme

Prakash493 — Mon, 22 Apr 2019 16:43:27 GMT

does it create any issues if i run this script on search head , i mean any performance issues ?

Re: ./splunk cmd python fill_summary_index.py -app splunkdotcom -name "*" -et -mon@mon -lt @mon -dedup true -auth admin:changeme

woodcock — Tue, 23 Apr 2019 03:10:35 GMT

That is correct.