Knowledge Management

Web Intelligence App - backfill not working right

rcovert
Path Finder

I have ran the backfill_all.sh script to backfill from July 1- July 17, 2011 (with no errors) but some of the data is missing. For example, if I run the 'Traffic by HTTP Good Status' report, I see data for the whole time range. When I run 'Pageviews Unique Visitors' report, I only see data from Jul1 - July 3.

I saw that the source="User session visitor source*", so I edited by backfill_all.sh and:
1. set the earliest time to July 4, 2011 (1309752000)
2. set the latest time to July 17, 2011 (1310875200)
3. commented out all searches except for

a. "$splunkBin/splunk cmd python $splunkBin/fill_summary_index.py -app webintelligence -name "User session visitor source hourly summary - regenerator" -et $earliestTime -lt $latestTime -dedup false -j $simultSearches -auth $1:$2;"

b. $splunkBin/splunk cmd python $splunkBin/fill_summary_index.py -app webintelligence -name "Pageview hourly summary - regenerator" -et $earliestTime -lt $latestTime -dedup false -j $simultSearches -auth $1:$2;

c.  $splunkBin/splunk cmd python $splunkBin/fill_summary_index.py -app webintelligence -name "User session visitor source daily summary - regenerator" -et $earliestTime -lt $latestTime -dedup false -j $simultSearches -auth $1:$2;

d.  $splunkBin/splunk cmd python $splunkBin/fill_summary_index.py -app webintelligence -name "Pageview daily summary - regenerator" -et $earliestTime -lt $latestTime -dedup false -j $simultSearches -auth $1:$2;

I didn't receive any errors when the backfill script ran. However, the data is still not there. When I do a search for index="wi_summary*" AND source="user session visitor*", I still only see results for July 1-3.

Any ideas?

Tags (3)
0 Karma
1 Solution

rcovert
Path Finder

I found the answer to my question. My enterprise trial had expired and summary indexing is not supported in the free version.

View solution in original post

rcovert
Path Finder

I found the answer to my question. My enterprise trial had expired and summary indexing is not supported in the free version.

bgoldman69
New Member

so how are those of us that are trying to make a purchasing decision supposed to trial this module if it wont work?

0 Karma
Get Updates on the Splunk Community!

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...