fill_summary_index.py how to locate and run this script in splunks file directory

dirkbaumann — Mon, 28 Sep 2020 14:34:50 GMT

Hi together,
I have found the following fill_summray_index.py script under: http://wiki.splunk.com/Community:Summary_Indexing_Back_Fill
I have customized it and now I have 2 questions:
Where do I locate the script?
How do I run the script?

Re: fill_summary_index.py how to locate and run this script in splunks file directory

jhupka — Thu, 15 Aug 2013 15:30:44 GMT

Are you running this on a unix server? I'll assume so, mainly because that is what I am familiar with - if it is Windows then I am not so sure. The script doesn't have to be anywhere special, you just need access to the splunk and python commands via your path.

You should be the user that the splunk application is installed as (so log in as that user, sudo to it, etc), and the splunk command should be in your path (i.e. the one installed in [SPLUNK_HOME]/bin/). Finally, python should be in your path, too - chances are they python you will be using is in [SPLUNK_HOME]/bin/ as well.

You can check from the command line where splunk and python are by doing:

which splunk
which python

Both of those should return you the path where those are. Now you can run the script from any location you want - all the script does is iteratively invoke the splunk CLI with your search for the interval/time-range you modified the script to be in. That would be something like the following command:

python mySummaryScript.py

One suggestion if you haven't done it already - create another copy of your script that only summarizes 3 or 4 intervals over a smaller time range. Then have the script just dump this into index=summary. Run that one first, wait a few minutes for the summary data to show up, and then verify in index=summary that things look good before running your full script that populates your real summary index. This way you don't inadvertently put in bad data to your real summary if you have a typo.

topic fill_summary_index.py how to locate and run this script in splunks file directory in Splunk Search

fill_summary_index.py how to locate and run this script in splunks file directory

Re: fill_summary_index.py how to locate and run this script in splunks file directory