fill_summary_index.py Error

[mukulsud]

Hi,

I just installed the Web Intelligence App and am running the back fill job. A grep on the log file reveals this error:

Indexing Error:
File "/opt/splunk/bin/fill_summary_index.py", line 490, in
owner=owner, triggerActions=triggerStr, now=st)
File "/opt/splunk/lib/python2.7/site-packages/splunk/search/init.py", line 2120, in call
return getattr(_savedModuleInstance, self.methodName)(*args, **kwargs)
File "/opt/splunk/lib/python2.7/site-packages/splunk/saved.py", line 62, in dispatchSavedSearch
raise splunk.SearchException, msg['text']
splunk.SearchException: In handler 'savedsearch': Error while dispatching search

Has anyone else had this? - Any suggestions for a fix?

The script has been running for over 15 hours now and hasn't progressed very much. Does anyone have some runtime stats?

[efullman]

When the back-fill app crashes it can leave a *.lock. In my experience I was running too many simultaneous searches for the back-fill. When you run less in my case it was five, it runs faster and doesn't crash.

[cheganbm]

I have this very same error while building the backlog for a newly created summary report. This error keeps happening every 5-10minutes.

How can I determine the reason why this keeps occurring?
Thanks

[efullman]

I've had the same thing happen with a different index.

You've probably figured out that the back fill app crashed.

You should make a check for *.lock file in the log directory under the Web Intelligence App. It probably won't be there in a crash, it usually happens if you close the CLI window.

Then look for the last UTC time that was reported by the app if you still have the data. Put that into the script on the et parameter and start up the script again. You should probably monitor to see if it crashes again.

I don't know what the problem is, just how to treat the symptoms.