Summary Index Backfill

[kenchisho]

Hi guys,

I am trying to backfill data into a summary index...

when i run the command using the py script i get an error saying:

*** For saved search 'fw_web_monthly_top_domains' ***
No scheduled times for your time range.

I have turned off the schedule for this search and tried playing around with the et and lt values with no effect...

any ideas?

[clyde772]

kenchisho,

Make sure to check the few things,

1. Saved search should have a proper scheduling set-up, ie */5 * * * * or every X.
2. Make sure that perticular saved search have proper authrization setup to share, default splunk seems to save it as private search so it can't be shared.

Clyde772.

[kenchisho]

the schedule is set to run at midnight on the first day of every month...

0 0 1 * *

[jbsplunk]

what is the schedule for 'fw_web_monthly_top_domains'?

[kenchisho]

Hi... here is the complete command...

./splunk cmd python fill_summary_index.py -app noc -index firewall_summary -name fw_web_monthly_top_domain -et -1mon@mon -lt @mon -j 8 -owner admin -showprogress true -auth admin:changeme

[imrago]

please post the complete command