Getting Data In

Query about fill summary index

lanilim16
Explorer

I've tried to run this..

./splunk cmd python fill_summary_index.py -app search -name "summary" -et 06/14/2015:08:00:00 -lt 06/14/2015:08:59:59 -dedup true

but didn't work, what's the format of the date?

Failed to get list of scheduled times for saved search 'summary-etransfer' (app = 'search', error = '[HTTP 400] Bad Request; [{'text': "\n In handler 'savedsearch': Cannot parse time argument 'earliest_time': '06/14/2015:08:00:00'", 'type': 'ERROR', 'code': None}]'

Tags (2)
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

According to the script's usage output, epoch integers or splunk relative time notation.

-et <string>            Earliest time (required).  Either a UTC time (integer since unix epoch) 
                                        or a Splunk search relative time string [1].

-lt <string>            Latest time (required).  Either a UTC time (integer since unix epoch) 
                                        or a Splunk search relative time string [1].
Get Updates on the Splunk Community!

Extending Splunk AI Assistant for SPL to Splunk Enterprise customers!

Howdy Splunk Community! It’s an exciting day here at Splunk – Splunk AI Assistant for SPL version 1.3.0 is now ...

Developer Spotlight with Qmulos

Qmulos: Building a Next-Level Cybersecurity Business through Splunk Apps Qmulos started as a scrappy startup ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Enhance Security Operations with Automated Threat Analysis in the Splunk EcosystemAre you leveraging ...