I have ran the backfill_all.sh script to backfill from July 1- July 17, 2011 (with no errors) but some of the data is missing. For example, if I run the 'Traffic by HTTP Good Status' report, I see data for the whole time range. When I run 'Pageviews Unique Visitors' report, I only see data from Jul1 - July 3.
I saw that the source="User session visitor source*", so I edited by backfill_all.sh and:
1. set the earliest time to July 4, 2011 (1309752000)
2. set the latest time to July 17, 2011 (1310875200)
3. commented out all searches except for
a. "$splunkBin/splunk cmd python $splunkBin/fill_summary_index.py -app webintelligence -name "User session visitor source hourly summary - regenerator" -et $earliestTime -lt $latestTime -dedup false -j $simultSearches -auth $1:$2;"
b. $splunkBin/splunk cmd python $splunkBin/fill_summary_index.py -app webintelligence -name "Pageview hourly summary - regenerator" -et $earliestTime -lt $latestTime -dedup false -j $simultSearches -auth $1:$2;
c. $splunkBin/splunk cmd python $splunkBin/fill_summary_index.py -app webintelligence -name "User session visitor source daily summary - regenerator" -et $earliestTime -lt $latestTime -dedup false -j $simultSearches -auth $1:$2;
d. $splunkBin/splunk cmd python $splunkBin/fill_summary_index.py -app webintelligence -name "Pageview daily summary - regenerator" -et $earliestTime -lt $latestTime -dedup false -j $simultSearches -auth $1:$2;
I didn't receive any errors when the backfill script ran. However, the data is still not there. When I do a search for index="wi_summary*" AND source="user session visitor*", I still only see results for July 1-3.
Any ideas?
I found the answer to my question. My enterprise trial had expired and summary indexing is not supported in the free version.
I found the answer to my question. My enterprise trial had expired and summary indexing is not supported in the free version.
so how are those of us that are trying to make a purchasing decision supposed to trial this module if it wont work?