https://community.splunk.com/t5/Knowledge-Management/Summary-Index-Setup-Now-How-to-Load-Old-Data/m-p/40678#M366 <P>OK, I've just discovered the fill_summary_index.py script! <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> <P><A href="http://docs.splunk.com/Documentation/Splunk/4.1.5/Knowledge/Managesummaryindexgapsandoverlaps#Use_the_backfill_script_to_add_other_data_or_fill_summary_index_gaps" target="_blank">http://docs.splunk.com/Documentation/Splunk/4.1.5/Knowledge/Managesummaryindexgapsandoverlaps#Use_the_backfill_script_to_add_other_data_or_fill_summary_index_gaps</A></P> Mon, 28 Sep 2020 13:22:27 GMT aferone 2020-09-28T13:22:27Z https://community.splunk.com/t5/Knowledge-Management/Summary-Index-Setup-Now-How-to-Load-Old-Data/m-p/40677#M365 <P>I am using the following query to load firewall data into a summary index I've created:</P> <P>host="aegis1.grc.nasa.gov" | sitop policy_id</P> <P>This query runs every 5 minutes and it working well.</P> <P>However, now, I want to be able to "backfill" data into this summary index, using past firewall data. How is this done? I tried scheduling the query from the beginning of the year, but I'm not sure if it worked. </P> <P>Any ideas?</P> <P>Thanks!</P> Fri, 22 Feb 2013 16:25:33 GMT https://community.splunk.com/t5/Knowledge-Management/Summary-Index-Setup-Now-How-to-Load-Old-Data/m-p/40677#M365 aferone 2013-02-22T16:25:33Z https://community.splunk.com/t5/Knowledge-Management/Summary-Index-Setup-Now-How-to-Load-Old-Data/m-p/40678#M366 <P>OK, I've just discovered the fill_summary_index.py script! <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> <P><A href="http://docs.splunk.com/Documentation/Splunk/4.1.5/Knowledge/Managesummaryindexgapsandoverlaps#Use_the_backfill_script_to_add_other_data_or_fill_summary_index_gaps" target="_blank">http://docs.splunk.com/Documentation/Splunk/4.1.5/Knowledge/Managesummaryindexgapsandoverlaps#Use_the_backfill_script_to_add_other_data_or_fill_summary_index_gaps</A></P> Mon, 28 Sep 2020 13:22:27 GMT https://community.splunk.com/t5/Knowledge-Management/Summary-Index-Setup-Now-How-to-Load-Old-Data/m-p/40678#M366 aferone 2020-09-28T13:22:27Z