Getting Data In

Query about fill summary index

lanilim16
Explorer

I've tried to run this..

./splunk cmd python fill_summary_index.py -app search -name "summary" -et 06/14/2015:08:00:00 -lt 06/14/2015:08:59:59 -dedup true

but didn't work, what's the format of the date?

Failed to get list of scheduled times for saved search 'summary-etransfer' (app = 'search', error = '[HTTP 400] Bad Request; [{'text': "\n In handler 'savedsearch': Cannot parse time argument 'earliest_time': '06/14/2015:08:00:00'", 'type': 'ERROR', 'code': None}]'

Tags (2)
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

According to the script's usage output, epoch integers or splunk relative time notation.

-et <string>            Earliest time (required).  Either a UTC time (integer since unix epoch) 
                                        or a Splunk search relative time string [1].

-lt <string>            Latest time (required).  Either a UTC time (integer since unix epoch) 
                                        or a Splunk search relative time string [1].
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Unmerging HTML Tables

[Puzzles] Solve, Learn, Repeat: Unmerging HTML TablesFor a previous puzzle, I needed some sample data, and ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...

AI for AppInspect

We’re excited to announce two new updates to AppInspect designed to save you time and make the app approval ...