topic Re: Summary Index Backfill in Knowledge Management

Summary Index Backfill

kenchisho — Mon, 28 Sep 2020 11:23:39 GMT

Hi guys,

I am trying to backfill data into a summary index...

when i run the command using the py script i get an error saying:

*** For saved search 'fw_web_monthly_top_domains' ***
No scheduled times for your time range.

I have turned off the schedule for this search and tried playing around with the et and lt values with no effect...

any ideas?

Re: Summary Index Backfill

imrago — Mon, 13 Feb 2012 22:40:55 GMT

please post the complete command

Re: Summary Index Backfill

kenchisho — Mon, 28 Sep 2020 11:23:52 GMT

Hi... here is the complete command...

./splunk cmd python fill_summary_index.py -app noc -index firewall_summary -name fw_web_monthly_top_domain -et -1mon@mon -lt @mon -j 8 -owner admin -showprogress true -auth admin:changeme

Re: Summary Index Backfill

jbsplunk — Mon, 28 Sep 2020 11:24:05 GMT

what is the schedule for 'fw_web_monthly_top_domains'?

Re: Summary Index Backfill

kenchisho — Tue, 14 Feb 2012 22:18:30 GMT

the schedule is set to run at midnight on the first day of every month...

0 0 1 * *

Re: Summary Index Backfill

clyde772 — Mon, 30 Jul 2012 02:10:02 GMT

kenchisho,

Make sure to check the few things,

Saved search should have a proper scheduling set-up, ie */5 * * * * or every X.
Make sure that perticular saved search have proper authrization setup to share, default splunk seems to save it as private search so it can't be shared.

Clyde772.