Knowledge Management

Schedule automatic summary backfill?

the_wolverine
Champion

I'd like to have summary backfill run on a scheduled basis to fill in the gaps automatically. I'd probably run this during non-peak hours to reduce any impact on the servers.

How can this be done?

inventsekar
Ultra Champion

http://docs.splunk.com/Documentation/Splunk/6.4.2/Knowledge/Managesummaryindexgapsandoverlaps
Use the backfill script to add other data or fill summary index gaps
The fill_summary_index.py script backfills gaps in summary index collection by
running the saved searches that populate the summary index as they would have
been executed at their regularly scheduled times for a given time range.

check this one as well.. FYI - This document refers to 3.x versions of Splunk.
http://wiki.splunk.com/Community:Summary_Indexing_Back_Fill

0 Karma

pradeepkumarg
Influencer

Did you get around with this?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...