Summary Index -nolocal

[emiller42]

Hello!

I've got a distributed Splunk setup where the indexers and search heads live on separate hosts. (The indexers are also clustered) I'm attempting to backfill a summary search, and make sure that I don't duplicate data where it may already exist. According to the Documentation contained here, there is a -nolocal flag to use in this case specifically. However, when I attempt to use the flag, I get an error stating: Invalid option '-nolocal'

Any idea why the discrepancy?

Here is the full command:

splunk cmd python fill_summary_index.py -app my_app -name summary_search -et -90d@d -lt @h -dedup true -nolocal true -j 8 -owner username -auth username:password

[yannK · Accepted solution]

The option -nolocal was introduced in splunk 6.0
The documentation is incorrect and will be updated.

[emiller42]

Thank you! Another reason to beg and plead to get our enterprise install upgraded.

Does this mean there is no mechanism to do what I want in Splunk 5.x?