topic Re: Summary Index -nolocal in Knowledge Management

Summary Index -nolocal

emiller42 — Mon, 07 Apr 2014 14:56:43 GMT

Hello!

I've got a distributed Splunk setup where the indexers and search heads live on separate hosts. (The indexers are also clustered) I'm attempting to backfill a summary search, and make sure that I don't duplicate data where it may already exist. According to the Documentation contained here, there is a -nolocal flag to use in this case specifically. However, when I attempt to use the flag, I get an error stating: Invalid option '-nolocal'

Any idea why the discrepancy?

Here is the full command:

splunk cmd python fill_summary_index.py -app my_app -name summary_search -et -90d@d -lt @h -dedup true -nolocal true -j 8 -owner username -auth username:password

Re: Summary Index -nolocal

yannK — Tue, 27 May 2014 20:10:17 GMT

The option -nolocal was introduced in splunk 6.0
The documentation is incorrect and will be updated.

Re: Summary Index -nolocal

emiller42 — Tue, 27 May 2014 20:56:15 GMT

Thank you! Another reason to beg and plead to get our enterprise install upgraded.

Does this mean there is no mechanism to do what I want in Splunk 5.x?