Knowledge Management

fill_summary_index metrics index , duplicates


We are trying to use the script to backfill times when the data isn't populated in a metrics based index. The script is not detecting gaps, it is re-running the searches for the defined time range.

I would assume  that the issue might be with the default dedupsearch:

dedupsearch = 'search splunk_server=local index=$index$ $namefield$="$name$" | stats count by $timefield$'

which is not compatible with metrics based indexes.

Any recommendations?


Labels (1)
0 Karma