Getting Data In

Query about fill summary index

lanilim16
Explorer

I've tried to run this..

./splunk cmd python fill_summary_index.py -app search -name "summary" -et 06/14/2015:08:00:00 -lt 06/14/2015:08:59:59 -dedup true

but didn't work, what's the format of the date?

Failed to get list of scheduled times for saved search 'summary-etransfer' (app = 'search', error = '[HTTP 400] Bad Request; [{'text': "\n In handler 'savedsearch': Cannot parse time argument 'earliest_time': '06/14/2015:08:00:00'", 'type': 'ERROR', 'code': None}]'

Tags (2)
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

According to the script's usage output, epoch integers or splunk relative time notation.

-et <string>            Earliest time (required).  Either a UTC time (integer since unix epoch) 
                                        or a Splunk search relative time string [1].

-lt <string>            Latest time (required).  Either a UTC time (integer since unix epoch) 
                                        or a Splunk search relative time string [1].
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

.conf25 Global Broadcast: Don’t Miss a Moment

Hello Splunkers, .conf25 is only a click away.  Not able to make it to .conf25 in person? No worries, you can ...

Observe and Secure All Apps with Splunk

 Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What's New in Splunk Observability - August 2025

What's New We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what is ...