Knowledge Management

Summary Index -nolocal

emiller42
Motivator

Hello!

I've got a distributed Splunk setup where the indexers and search heads live on separate hosts. (The indexers are also clustered) I'm attempting to backfill a summary search, and make sure that I don't duplicate data where it may already exist. According to the Documentation contained here, there is a -nolocal flag to use in this case specifically. However, when I attempt to use the flag, I get an error stating: Invalid option '-nolocal'

Any idea why the discrepancy?

Here is the full command:

splunk cmd python fill_summary_index.py -app my_app -name summary_search -et -90d@d -lt @h -dedup true -nolocal true -j 8 -owner username -auth username:password
Tags (1)
0 Karma
1 Solution

yannK
Splunk Employee
Splunk Employee

The option -nolocal was introduced in splunk 6.0
The documentation is incorrect and will be updated.

View solution in original post

yannK
Splunk Employee
Splunk Employee

The option -nolocal was introduced in splunk 6.0
The documentation is incorrect and will be updated.

View solution in original post

emiller42
Motivator

Thank you! Another reason to beg and plead to get our enterprise install upgraded.

Does this mean there is no mechanism to do what I want in Splunk 5.x?

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!