Archive
Highlighted

Help! Summary search process stuck ?

Champion

I started running the fill_summary_index.py script and my session was interrupted. The summary backfill process never completed and I'm unable to restart it. I've tried restarting Splunk but it still thinks that a fill_summary_index instance is still running:

# ./splunk cmd python fill_summary_index.py 
Please enter the app that contains the search(es): search
An instance of fill_summary_index is already running for app=search

What can I do to cancel it and restart it?

Tags (1)
Highlighted

Re: Help! Summary search process stuck ?

Champion

Per Splunk Support, there's a fsidx*.lock file in the app directory that the script was run against. In my case, the search app:

/opt/splunk/etc/apps/search/log]# ls fsidxrlKD2v.lock

After deleting the lock file I was able to relaunch the summary backfill script.

Highlighted

Re: Help! Summary search process stuck ?

Champion

Thanks, Alex 😉

0 Karma
Highlighted

Re: Help! Summary search process stuck ?

Champion
0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.