Thanks a lot! I had a similar problem. ... View more

I come to you from the future! All joking aside, issues such as these were places where Splunk themselves realized the limitations in summary indexing. It is a great tool for some things, but has some serious architectural gaps. In the modern world - as of Splunk 6.0 or so - we use Data Models and Data Model acceleration in order to achieve the performance advantages of summary indexing without all of the operational downsides of summary indexing. If you are still using Splunk (this is a 4 year old unanswered post afterall) - then the docs on DMs and Acceleration will give you a hint how to proceed: http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Aboutdatamodels http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Acceleratedatamodels ... View more

You could use the backfill script (fill_summary_index.py) to fill in the missing summary indexes. This does work out the time slices for which summary data already exists and only generates the missing summary indexes. You would have to schedule this outside splunk but it would work. ... View more

Not sure if this what you mean but you can run splunk searches from the CLI as follows: splunk search 'index=meh criteria' -app myapp -earliest_time -2h -latest_time -auth user:password ... View more

One option that I can think of is to append a result to the search that generates the information for outputlookup with synthetical values that are never matched by the lookup. Eg. ... | append [ | stats count | fields - count | eval field1="__INVALID__" | eval field2="__INVALID__" | eval ... ] | outputlookup mylookup Where field1, field2, etc are the columns in your lookup file. This forces the results to be written every time. The downside is the unnecessary entry in the lookup file. ... View more

I played with MAX_DAYS_AGO and MAX_DAYS_HENCE and now it seems to be working without any issues. ... View more

Note that the 500MB is an indexed per day limit. Splunk imposes no limit on the total amount of data stored, the limit there would be the size of the disk. There is no need to archive off the data to keep the total value under 500MB. ... View more