Archive
Highlighted

Help! Summary search process stuck ?

Champion

I started running the fill_summary_index.py script and my session was interrupted. The summary backfill process never completed and I'm unable to restart it. I've tried restarting Splunk but it still thinks that a fill_summary_index instance is still running:

# ./splunk cmd python fill_summary_index.py 
Please enter the app that contains the search(es): search
An instance of fill_summary_index is already running for app=search

What can I do to cancel it and restart it?

Tags (1)
Highlighted

Re: Help! Summary search process stuck ?

Champion

Per Splunk Support, there's a fsidx*.lock file in the app directory that the script was run against. In my case, the search app:

/opt/splunk/etc/apps/search/log]# ls fsidxrlKD2v.lock

After deleting the lock file I was able to relaunch the summary backfill script.

Highlighted

Re: Help! Summary search process stuck ?

Champion

Thanks, Alex 😉

0 Karma

Re: Help! Summary search process stuck ?

Splunk Employee
Splunk Employee
0 Karma