Hello,
I ran the fill_summary_index.py script to backfill the data for one of my summary indexed saved searches. However I realized that I gave the wrong time frame as the argument and killed the fill_summary_index.py process while it was still running. Now I am trying to start a new fill_summary_index.py process with the correct timeframe but I keep getting the following error -
"An instance of fill_summary_index is already running for app=search"
I stopped and started all my splunk processes but I am continuing to get this error even after a complete restart of the Splunk processes on the system. Could you please let me know how I can resolve this issue?
Thanks in advance for any assistance.
I checked out the fill_summary_index.py script and noticed that a lock file gets created under the logs dir in the app context (search app in my case). Once I removed the lock file I was able to run the script again.