Knowledge Management

Web Intelligence App - backfill not working right

rcovert
Path Finder

I have ran the backfill_all.sh script to backfill from July 1- July 17, 2011 (with no errors) but some of the data is missing. For example, if I run the 'Traffic by HTTP Good Status' report, I see data for the whole time range. When I run 'Pageviews Unique Visitors' report, I only see data from Jul1 - July 3.

I saw that the source="User session visitor source*", so I edited by backfill_all.sh and:
1. set the earliest time to July 4, 2011 (1309752000)
2. set the latest time to July 17, 2011 (1310875200)
3. commented out all searches except for

a. "$splunkBin/splunk cmd python $splunkBin/fill_summary_index.py -app webintelligence -name "User session visitor source hourly summary - regenerator" -et $earliestTime -lt $latestTime -dedup false -j $simultSearches -auth $1:$2;"

b. $splunkBin/splunk cmd python $splunkBin/fill_summary_index.py -app webintelligence -name "Pageview hourly summary - regenerator" -et $earliestTime -lt $latestTime -dedup false -j $simultSearches -auth $1:$2;

c.  $splunkBin/splunk cmd python $splunkBin/fill_summary_index.py -app webintelligence -name "User session visitor source daily summary - regenerator" -et $earliestTime -lt $latestTime -dedup false -j $simultSearches -auth $1:$2;

d.  $splunkBin/splunk cmd python $splunkBin/fill_summary_index.py -app webintelligence -name "Pageview daily summary - regenerator" -et $earliestTime -lt $latestTime -dedup false -j $simultSearches -auth $1:$2;

I didn't receive any errors when the backfill script ran. However, the data is still not there. When I do a search for index="wi_summary*" AND source="user session visitor*", I still only see results for July 1-3.

Any ideas?

Tags (3)
0 Karma
1 Solution

rcovert
Path Finder

I found the answer to my question. My enterprise trial had expired and summary indexing is not supported in the free version.

View solution in original post

rcovert
Path Finder

I found the answer to my question. My enterprise trial had expired and summary indexing is not supported in the free version.

bgoldman69
New Member

so how are those of us that are trying to make a purchasing decision supposed to trial this module if it wont work?

0 Karma
Get Updates on the Splunk Community!

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...

Splunk MCP & Agentic AI: Machine Data Without Limits

Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization uses ...