Entering earliest and latest time for backfill summary search. What is the format?

[the_wolverine]

I'm having trouble figuring out the proper syntax for specifying an exact date/time for my summary backfill search. For example I have a start date of February 2, 2012 5am. I've tried the following without success:

2012-02-02 05:00:00
02/02/2012 05:00:00
02-02-2012T05:00:00

[skawasaki_splun · Accepted solution]

It turns out you have to use epoch time. I found this out when I actually opened the fill_summary_index.py script and saw

Usage: splunk cmd python fill_summary_index.py [OPTIONS]

***Note: <boolean> options accept the values "1", "t", "true", or "yes" for true
                                        and "0", "f", "false", or "no" for false

-et <string>            Earliest time (required).  Either a UTC time (integer since unix epoch)
                                        or a Splunk search relative time string [1].

-lt <string>            Latest time (required).  Either a UTC time (integer since unix epoch)
                                        or a Splunk search relative time string [1].

[gkanapathy]

I use epoch time format, though other formats should also work.

[Simeon]

Usually the summary search is scheduled and this format should work:

%m/%d/%Y:%H:%M:%S

For example, this should search all os data between the 10th and 11th of March:

index=os earliest=03/10/2012:0:0:0 latest=03/11/2012:0:0:0

Detailing where you set this (at the scheduler wizard?) would help.

[the_wolverine]

http://docs.splunk.com/Documentation/Splunk/latest/User/ChangeTheTimeRangeOfYourSearch#Syntax_for_re...

This document was referenced in the summary script's help section but it didn't answer my question. I still don't have a working example.

The example provided on that page does not work:
earliest_time=10/19/2009:0:0:0