Knowledge Management

Backfill command not finding searches

johndunlea
Explorer

When I run the backfill command for summary index searches in an app, I get an output saying that there is 30 searches found, but that 0 will be added to list.

This is the command to backfill TWO summary indexes, using only TWO searches (there are a total of THREE searches in this app, however one is not for summary index gen):

./splunk cmd python fill_summary_index.py -app indexStatsApp -name "*" -et -mon@mon -lt @mon -dedup true -auth admin:XXXXXXXXXXX

After running this command, I get the following result:

Getting list of all saved searches for selected app=indexStatsApp and owner=nobody
... found 30 saved searches
... of those, 0 will be added to list (those that are enabled, scheduled, and has summary_index action)

No searches to run

  • First of all, im not sure where Splunk is finding 30 searches, becuase there are only 3 in aoo.

  • Secondly, I don't know why it cannot find the index searches to backfill the indexes. Summary indexing is turned on, and they are all saved, scheduled searches.

Can anybody shed some light on this foor me?? Thanks!

bwooden
Splunk Employee
Splunk Employee

The fill summary script will run each search as it was scheduled to run. If there is one search that would have created 10 summary points - the script will report it as 10 searches.

Let us say there is a search called summarize_daily that runs once each day. If we try to fill its summary using the script for one week (-et -1w@w -lt @w), it will run 7 searches.

The a -dedup true setting will have it skip over summaries that have already been performed. In the above example, if the intended summaries already exist and the dedup flag is used, then 0 searches will be performed.

Next steps:

  1. Run against one search explicitly (versus the asterik) for troubleshooting purposes.
  2. If that returns 0, manually check the summary data to see if it already exists for the time specified.
  3. If no summary data is found - verify summary indexing is enabled for that search.
0 Karma

johndunlea
Explorer

Thanks bwooden. I will check that now and see what I come up with.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...