Knowledge Management

fill_summary_index.py is not doing dedup

luhadia_aditya
Path Finder

I am testing this script to be utilised in production and in my test-bed i found that this script is not doing the dedup, meaning even if the saved search, that populates the summary index, had run at a particular time (say 5 am), script is still triggering the search at the same moment when this time (5 am) falls in the -et #### -lt ##### range and writing the data in to summary index causing duplication >> affecting the stats badly.

Search trigger command --

/opt/splunk/bin/splunk cmd python fill_summary_index.py -app <app_name> -name '<saved_search_name>' -et 1420781400 -lt 1420788600 -dedup true -auth admin:<pwd>

I have already included the -dedup true argument.

I am aware that this -dedup true is different from the search command | dedup and its being triggered on search head (with forward data enabled to indexers) - Splunk 6.0.4 (build 207768)

Correct me if I am missing anything, thanks in advance!!

0 Karma
1 Solution

luhadia_aditya
Path Finder

Got the hack, was missing an argument of nolocal -

/opt/splunk/bin/splunk cmd python fill_summary_index.py -app -name -et -7d@d -lt @d -dedup true -nolocal true -auth admin:

View solution in original post

0 Karma

luhadia_aditya
Path Finder

Got the hack, was missing an argument of nolocal -

/opt/splunk/bin/splunk cmd python fill_summary_index.py -app -name -et -7d@d -lt @d -dedup true -nolocal true -auth admin:

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...