Are you a member of the Splunk Community?
- Find Answers
- :
- Splunk Administration
- :
- Admin Other
- :
- Knowledge Management
- :
- An instance of fill_summary_index is already runni...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I had the Admin of our Splunk Inder run a fill_summary_index.py job. The first time he ran it, it worked but quit after indexing 20 Days of the 4 Months worth of data.
He is now getting the following error when trying to rerun the job, "An instance of fill_summary_index is already running for app=search".
So far he has done the following:
Reboot of the System, did not help.
Ran "ps aux | grep fill_summary_index" command, no results.
Looked for locks in $SPLUNK_HOME/etc/apps/Catch/log/ but says there is no such file.
Any suggestions on what to do next?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
it has to be a lock file somewhere...That only reason i know for this message outside the backfill still running in jobs...did you search locks in all $SPLUNK_HOME/*? And checked job manager?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I am also having similar Problem, Should we delete the lock file in order to run it again?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
yes you need to delete it for the backfill command to restart
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
it has to be a lock file somewhere...That only reason i know for this message outside the backfill still running in jobs...did you search locks in all $SPLUNK_HOME/*? And checked job manager?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Found the lock file under the name of the app. $SPLUNK_HOME/etc/apps/Search/log/ . Thank you for the reply.
Splunk Observability for AI
Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...
Splunk Observability as Code: From Zero to Dashboard
