When I run the backfill command for summary index searches in an app, I get an output saying that there is 30 searches found, but that 0 will be added to list.
This is the command to backfill TWO summary indexes, using only TWO searches (there are a total of THREE searches in this app, however one is not for summary index gen):
./splunk cmd python fill_summary_index.py -app indexStatsApp -name "*" -et -mon@mon -lt @mon -dedup true -auth admin:XXXXXXXXXXX
After running this command, I get the following result:
Getting list of all saved searches for selected app=indexStatsApp and owner=nobody
... found 30 saved searches
... of those, 0 will be added to list (those that are enabled, scheduled, and has summary_index action)
No searches to run
First of all, im not sure where Splunk is finding 30 searches, becuase there are only 3 in aoo.
Secondly, I don't know why it cannot find the index searches to backfill the indexes. Summary indexing is turned on, and they are all saved, scheduled searches.
Can anybody shed some light on this foor me?? Thanks!
The fill summary script will run each search as it was scheduled to run. If there is one search that would have created 10 summary points - the script will report it as 10 searches.
Let us say there is a search called summarize_daily
that runs once each day. If we try to fill its summary using the script for one week (-et -1w@w -lt @w
), it will run 7 searches.
The a -dedup true
setting will have it skip over summaries that have already been performed. In the above example, if the intended summaries already exist and the dedup flag is used, then 0 searches will be performed.
Next steps:
Thanks bwooden. I will check that now and see what I come up with.