Knowledge Management

Web Intelligence App - backfill not working right

rcovert
Path Finder

I have ran the backfill_all.sh script to backfill from July 1- July 17, 2011 (with no errors) but some of the data is missing. For example, if I run the 'Traffic by HTTP Good Status' report, I see data for the whole time range. When I run 'Pageviews Unique Visitors' report, I only see data from Jul1 - July 3.

I saw that the source="User session visitor source*", so I edited by backfill_all.sh and:
1. set the earliest time to July 4, 2011 (1309752000)
2. set the latest time to July 17, 2011 (1310875200)
3. commented out all searches except for

a. "$splunkBin/splunk cmd python $splunkBin/fill_summary_index.py -app webintelligence -name "User session visitor source hourly summary - regenerator" -et $earliestTime -lt $latestTime -dedup false -j $simultSearches -auth $1:$2;"

b. $splunkBin/splunk cmd python $splunkBin/fill_summary_index.py -app webintelligence -name "Pageview hourly summary - regenerator" -et $earliestTime -lt $latestTime -dedup false -j $simultSearches -auth $1:$2;

c.  $splunkBin/splunk cmd python $splunkBin/fill_summary_index.py -app webintelligence -name "User session visitor source daily summary - regenerator" -et $earliestTime -lt $latestTime -dedup false -j $simultSearches -auth $1:$2;

d.  $splunkBin/splunk cmd python $splunkBin/fill_summary_index.py -app webintelligence -name "Pageview daily summary - regenerator" -et $earliestTime -lt $latestTime -dedup false -j $simultSearches -auth $1:$2;

I didn't receive any errors when the backfill script ran. However, the data is still not there. When I do a search for index="wi_summary*" AND source="user session visitor*", I still only see results for July 1-3.

Any ideas?

Tags (3)
0 Karma
1 Solution

rcovert
Path Finder

I found the answer to my question. My enterprise trial had expired and summary indexing is not supported in the free version.

View solution in original post

rcovert
Path Finder

I found the answer to my question. My enterprise trial had expired and summary indexing is not supported in the free version.

bgoldman69
New Member

so how are those of us that are trying to make a purchasing decision supposed to trial this module if it wont work?

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...