Knowledge Management

fill_summary_index metrics index , duplicates

imrago
Contributor

We are trying to use the fill_summary_index.py script to backfill times when the data isn't populated in a metrics based index. The script is not detecting gaps, it is re-running the searches for the defined time range.

I would assume  that the issue might be with the default dedupsearch:

dedupsearch = 'search splunk_server=local index=$index$ $namefield$="$name$" | stats count by $timefield$'

which is not compatible with metrics based indexes.

Any recommendations?

 

Labels (1)
0 Karma