topic Re: Summary index backfill issue in Reporting

Summary index backfill issue

uagraw01 — Fri, 09 Aug 2024 11:45:03 GMT

Hello Splunkers!!

I am executing below script for backfilling the summary index against my saved search. The script is working fine for date 4th and 6th august but it is not working for 5th of Aug. Please help me to suggest me some of the potential reasons why script is not working for 5th Aug, although I have data available to main index from where saved search push data to summary index.

Example of script which I executed so far for 5th Aug.

splunk cmd python fill_summary_index.py -app customer -name si_summary_search -et 1693883300 -lt 1693969700 -j 8 -owner admin -auth admin:yuuuyyyxx

As I am getting below Warning also for 4th 5th and 6th only.

Re: Summary index backfill issue

ITWhisperer — Sat, 10 Aug 2024 08:08:51 GMT

It looks like the script is failing for the data being used - depending on what the script actually does, you could try different time periods e.g. hourly through 5th to see if you can backfill your summary index that way. Alternatively, try running the search that the script uses (without the collect command) to see if there are any errors.

Re: Summary index backfill issue

uagraw01 — Mon, 12 Aug 2024 13:51:36 GMT

@ITWhisperer My script is executing fine but filling no data for 5th august in summary index.

Re: Summary index backfill issue

ITWhisperer — Mon, 12 Aug 2024 14:01:20 GMT

How can you say your script is executing fine if it is not doing what you expect?

Try running the search without the collect command as see what happens.

Try running the search with different time chunks (if possible) to see what happens.

Try running parts of the search to see whether data goes missing at any point.

Try other ways to diagnose your issue as you haven't given us any useful information (so far) to help you determine what might be going on

Re: Summary index backfill issue

uagraw01 — Tue, 13 Aug 2024 08:56:44 GMT

@ITWhisperer Today I used query of the default saved searches and manually collected to summary index from UI ( collect command) rather than to use of python script. Data is not visible to indexes.