Backfill command not finding searches

[johndunlea]

When I run the backfill command for summary index searches in an app, I get an output saying that there is 30 searches found, but that 0 will be added to list.

This is the command to backfill TWO summary indexes, using only TWO searches (there are a total of THREE searches in this app, however one is not for summary index gen):

./splunk cmd python fill_summary_index.py -app indexStatsApp -name "*" -et -mon@mon -lt @mon -dedup true -auth admin:XXXXXXXXXXX

After running this command, I get the following result:

Getting list of all saved searches for selected app=indexStatsApp and owner=nobody
... found 30 saved searches
... of those, 0 will be added to list (those that are enabled, scheduled, and has summary_index action)

No searches to run

• First of all, im not sure where Splunk is finding 30 searches, becuase there are only 3 in aoo.

• Secondly, I don't know why it cannot find the index searches to backfill the indexes. Summary indexing is turned on, and they are all saved, scheduled searches.

Can anybody shed some light on this foor me?? Thanks!

[bwooden]

The fill summary script will run each search as it was scheduled to run. If there is one search that would have created 10 summary points - the script will report it as 10 searches.

Let us say there is a search called summarize_daily that runs once each day. If we try to fill its summary using the script for one week (-et -1w@w -lt @w), it will run 7 searches.

The a -dedup true setting will have it skip over summaries that have already been performed. In the above example, if the intended summaries already exist and the dedup flag is used, then 0 searches will be performed.

Next steps:

1. Run against one search explicitly (versus the asterik) for troubleshooting purposes.
   
2. If that returns 0, manually check the summary data to see if it already exists for the time specified.
   
3. If no summary data is found - verify summary indexing is enabled for that search.

[johndunlea]

Thanks bwooden. I will check that now and see what I come up with.