Summary Index Setup, Now How to Load Old Data?

[aferone]

I am using the following query to load firewall data into a summary index I've created:

host="aegis1.grc.nasa.gov" | sitop policy_id

This query runs every 5 minutes and it working well.

However, now, I want to be able to "backfill" data into this summary index, using past firewall data. How is this done? I tried scheduling the query from the beginning of the year, but I'm not sure if it worked.

Any ideas?

Thanks!

[aferone · Accepted solution]

OK, I've just discovered the fill_summary_index.py script! 🙂

http://docs.splunk.com/Documentation/Splunk/4.1.5/Knowledge/Managesummaryindexgapsandoverlaps#Use_th...