using of year in cron schedule

[iKate]

How can one make a cron schedule in Splunk run just in specific year? This can be easily done in 8-digit type of cron schedules but splunk uses just 5 digits.

The case is that I need to backfill summary index only for several months of current year, but our statistics has these months in 2012 and 2011 years so setting schedule like 0 0 * 7-9 * will index data in both years that will be redundant and also will take twice more time and space.

p.s. I can't set earliest time in search or limit time in other way as we need the search to count for all the time.

[reed_kelly]

I didn't think you can specify retroactive cron schedules. Cron schedules dictate when jobs will run in the future.

Did you look at backfill script ($SPLUNK_HOME/bin/fill_summary_index.py)?

Manage summary index gaps and overlaps

[iKate]

Yes, I am using this script. And it's exactly about running and writing to summary index your searches, like they were launched in the past with periodicity set in the (cron)schedule.