After running this command, I get the following result:
Getting list of all saved searches for selected app=indexStatsApp and owner=nobody
... found 30 saved searches
... of those, 0 will be added to list (those that are enabled, scheduled, and has summary_index action)
No searches to run
First of all, im not sure where Splunk is finding 30 searches, becuase there are only 3 in aoo.
Secondly, I don't know why it cannot find the index searches to backfill the indexes. Summary indexing is turned on, and they are all saved, scheduled searches.
Can anybody shed some light on this foor me?? Thanks!
The fill summary script will run each search as it was scheduled to run. If there is one search that would have created 10 summary points - the script will report it as 10 searches.
Let us say there is a search called summarize_daily that runs once each day. If we try to fill its summary using the script for one week (-et -1w@w -lt @w), it will run 7 searches.
The a -dedup true setting will have it skip over summaries that have already been performed. In the above example, if the intended summaries already exist and the dedup flag is used, then 0 searches will be performed.
Run against one search explicitly (versus the asterik) for troubleshooting purposes.
If that returns 0, manually check the summary data to see if it already exists for the time specified.
If no summary data is found - verify summary indexing is enabled for that search.