topic Re: Question about fixing data in a summary search in Knowledge Management

Question about fixing data in a summary search

burwell — Tue, 29 Sep 2020 11:28:59 GMT

We have a summary search that runs every hour. I have read about the fill_summary_index.py

What i want to know is how do I fix data from several weeks ago. Things changed a few weeks ago and I need to adjust the summary search. Going forward things are good but how can I run the fill_summary_index.py and have it replace the data that is there?

I feel like with the dedup setting it would either skip or add into what I have. How do I replace for a time period.. or can I?

Thanks.

Re: Question about fixing data in a summary search

somesoni2 — Tue, 18 Oct 2016 03:20:25 GMT

I generally delete the corrupted/incomplete data from summary index and then backfill.

Re: Question about fixing data in a summary search

cmerriman — Tue, 18 Oct 2016 12:36:26 GMT

We do the same.

Re: Question about fixing data in a summary search

burwell — Tue, 18 Oct 2016 16:59:23 GMT

How do you delete the corrupt/incomplete data?

Re: Question about fixing data in a summary search

somesoni2 — Tue, 18 Oct 2016 17:04:27 GMT

We run the delete command to delete (technically it just makes the data unsearchable) the required data. We run a search with appropriate data-source (index/sourcetype/source/host) and time range, check if the search is returning the data that you want to delete, and then add "| delete " command at the end to delete/make-unsearchable the same. This link should give you more details on the delete command.

http://docs.splunk.com/Documentation/Splunk/4.3.2/Admin/RemovedatafromSplunk#Delete_data_from_future_searches

Re: Question about fixing data in a summary search

cmerriman — Tue, 18 Oct 2016 17:05:03 GMT

http://docs.splunk.com/Documentation/Splunk/6.5.0/Indexer/RemovedatafromSplunk

Re: Question about fixing data in a summary search

burwell — Thu, 27 Oct 2016 02:08:59 GMT

Thanks. If you post in the answers I will mark this as answered.