Splunk Search

Help creating backfill script

mwdbhyat
Builder

Hi there,

Can someone help me create my backfill script? I am creating a new summary index that runs every 10min with a time range of -15m@m to -5m@m, however when I first start using this I would like the previous 12weeks worth of data to be in it as well.. Could anyone help with scripting this (noob). Does this script have to be run by an admin from the cli?

Thanks

0 Karma
1 Solution

skoelpin
SplunkTrust
SplunkTrust

You will need to run the backfill command on the indexer as root/admin under the /bin folder

Try this

./splunk cmd python fill_summary_index.py -app YOUR_APP -name "SI_Populator" -et -12w@w -lt now -dedup true

Replace the following
YOUR_AAPP will need to be the name of the app your using.. It's most likely the search app
SI_Populator is the name of your populating search

The -dedup true means that it will not backfill data that's already summarized

You need to also make sure that the permissions of your populating search are not set to private

View solution in original post

0 Karma

skoelpin
SplunkTrust
SplunkTrust

You will need to run the backfill command on the indexer as root/admin under the /bin folder

Try this

./splunk cmd python fill_summary_index.py -app YOUR_APP -name "SI_Populator" -et -12w@w -lt now -dedup true

Replace the following
YOUR_AAPP will need to be the name of the app your using.. It's most likely the search app
SI_Populator is the name of your populating search

The -dedup true means that it will not backfill data that's already summarized

You need to also make sure that the permissions of your populating search are not set to private

0 Karma

mwdbhyat
Builder

Thanks for this! Could you please explain what the -et -1t mean ?

0 Karma

skoelpin
SplunkTrust
SplunkTrust

The -et and -lt are parameters which specify the time window it should backfill. et stands for earliest time which is 12 weeks ago on the week and -lt is latest time which is now

If this answered your question, can you please accept/like it?

0 Karma

mwdbhyat
Builder

Awesome, thanks for the help!

0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...