Splunk Search

fill_summary_index.py how to locate and run this script in splunks file directory

dirkbaumann
Explorer

Hi together,
I have found the following fill_summray_index.py script under: http://wiki.splunk.com/Community:Summary_Indexing_Back_Fill
I have customized it and now I have 2 questions:
Where do I locate the script?
How do I run the script?

Tags (1)
0 Karma

jhupka
Path Finder

Are you running this on a unix server? I'll assume so, mainly because that is what I am familiar with - if it is Windows then I am not so sure. The script doesn't have to be anywhere special, you just need access to the splunk and python commands via your path.

You should be the user that the splunk application is installed as (so log in as that user, sudo to it, etc), and the splunk command should be in your path (i.e. the one installed in [SPLUNK_HOME]/bin/). Finally, python should be in your path, too - chances are they python you will be using is in [SPLUNK_HOME]/bin/ as well.

You can check from the command line where splunk and python are by doing:

which splunk
which python

Both of those should return you the path where those are. Now you can run the script from any location you want - all the script does is iteratively invoke the splunk CLI with your search for the interval/time-range you modified the script to be in. That would be something like the following command:

python mySummaryScript.py

One suggestion if you haven't done it already - create another copy of your script that only summarizes 3 or 4 intervals over a smaller time range. Then have the script just dump this into index=summary. Run that one first, wait a few minutes for the summary data to show up, and then verify in index=summary that things look good before running your full script that populates your real summary index. This way you don't inadvertently put in bad data to your real summary if you have a typo.

Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...