Knowledge Management
Highlighted

Schedule automatic summary backfill?

Champion

I'd like to have summary backfill run on a scheduled basis to fill in the gaps automatically. I'd probably run this during non-peak hours to reduce any impact on the servers.

How can this be done?

Highlighted

Re: Schedule automatic summary backfill?

Influencer

Did you get around with this?

0 Karma
Highlighted

Re: Schedule automatic summary backfill?

Champion

http://docs.splunk.com/Documentation/Splunk/6.4.2/Knowledge/Managesummaryindexgapsandoverlaps
Use the backfill script to add other data or fill summary index gaps
The fillsummaryindex.py script backfills gaps in summary index collection by
running the saved searches that populate the summary index as they would have
been executed at their regularly scheduled times for a given time range.

check this one as well.. FYI - This document refers to 3.x versions of Splunk.
http://wiki.splunk.com/Community:Summary_Indexing_Back_Fill

0 Karma