For your convenience, here's a diff so you can apply the patch:
--
--- fill_summary_index.py 2016-05-13 00:05:14.000000000 +0200
+++ fill_summary_index_oko3.py 2016-06-10 15:17:18.000000000 +0200
@@ -9,6 +9,7 @@
import splunk.auth
import splunk.search
import splunk.util
+import splunk.entity as entity
import splunk.clilib.bundle_paths as bundle_paths
app = None
@@ -158,12 +159,12 @@
-timefield <string> The field in summary index data that contains the
scheduled time of the saved search that generated
that data
-
+
1 - For a full description of Splunk relative time strings, see:
http://docs.splunk.com/Documentation/Splunk/6.4.1/User/ChangeTheTimeRangeOfYourSearch#Syntax_for_relative_time_modifiers
'''
sys.exit(0)
-
+
def getBoolArg(opt, val):
try:
return splunk.util.normalizeBoolean(val, enableStrictMode=True)
@@ -349,7 +350,8 @@
cur_st_list = []
index = indexarg
try:
- ent = splunk.search.getSavedSearchWithTimes(ssname, et, lt, namespace=app, sessionKey=sk, owner=owner)
+ #ent = splunk.search.getSavedSearchWithTimes(ssname, et, lt, namespace=app, sessionKey=sk, owner=owner)
+ ent = entity.getEntity("/saved/searches", ssname, uri="/servicesNS/"+owner+"/"+app+"/saved/searches/"+ssname+"/scheduled_times", earliest_time=et, latest_time=lt, namespace=app, owner=owner, sessionKey=sk)
if 'scheduled_times' in ent:
for st in ent['scheduled_times']:
cur_st_list.append((ssname, st))
... View more
