Hi, When I run the backfill script I get the following error message:
[root@splunk_search_head bin]# ./splunk cmd python fill_summary_index.py -app Catch -name summary_daily_statistics -et -9mon@mon -lt now -owner admin -auth admin:xxxxxx
An instance of fill_summary_index is already running for app=Catch
[root@splunk_search_head bin]#
Any idea on how to fix the problem?
Thanks.
First, make sure that another instance isn't running. A command something like this should do the trick:
ps aux | grep fill_summary_index
If it's not, then check for a temporary file in $SPLUNK_HOME/etc/apps/Catch/log/
. If you have a "lock" file in that location, you should be able to remove it and then run fill_summary_index should work after that.
I believe the limitation is running on one instance of fill_summary_index
per splunk application.
First, make sure that another instance isn't running. A command something like this should do the trick:
ps aux | grep fill_summary_index
If it's not, then check for a temporary file in $SPLUNK_HOME/etc/apps/Catch/log/
. If you have a "lock" file in that location, you should be able to remove it and then run fill_summary_index should work after that.
I believe the limitation is running on one instance of fill_summary_index
per splunk application.
Thanks. removing the lock file works