Splunk Search

fill_summary_index.py how to locate and run this script in splunks file directory

dirkbaumann
Explorer

Hi together,
I have found the following fill_summray_index.py script under: http://wiki.splunk.com/Community:Summary_Indexing_Back_Fill
I have customized it and now I have 2 questions:
Where do I locate the script?
How do I run the script?

Tags (1)
0 Karma

jhupka
Path Finder

Are you running this on a unix server? I'll assume so, mainly because that is what I am familiar with - if it is Windows then I am not so sure. The script doesn't have to be anywhere special, you just need access to the splunk and python commands via your path.

You should be the user that the splunk application is installed as (so log in as that user, sudo to it, etc), and the splunk command should be in your path (i.e. the one installed in [SPLUNK_HOME]/bin/). Finally, python should be in your path, too - chances are they python you will be using is in [SPLUNK_HOME]/bin/ as well.

You can check from the command line where splunk and python are by doing:

which splunk
which python

Both of those should return you the path where those are. Now you can run the script from any location you want - all the script does is iteratively invoke the splunk CLI with your search for the interval/time-range you modified the script to be in. That would be something like the following command:

python mySummaryScript.py

One suggestion if you haven't done it already - create another copy of your script that only summarizes 3 or 4 intervals over a smaller time range. Then have the script just dump this into index=summary. Run that one first, wait a few minutes for the summary data to show up, and then verify in index=summary that things look good before running your full script that populates your real summary index. This way you don't inadvertently put in bad data to your real summary if you have a typo.

Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...