Deployment Architecture

fill_summary_index.py Error

mukulsud
Explorer

Hi,

I just installed the Web Intelligence App and am running the back fill job. A grep on the log file reveals this error:

Indexing Error:
File "/opt/splunk/bin/fill_summary_index.py", line 490, in
owner=owner, triggerActions=triggerStr, now=st)
File "/opt/splunk/lib/python2.7/site-packages/splunk/search/init.py", line 2120, in call
return getattr(_savedModuleInstance, self.methodName)(*args, **kwargs)
File "/opt/splunk/lib/python2.7/site-packages/splunk/saved.py", line 62, in dispatchSavedSearch
raise splunk.SearchException, msg['text']
splunk.SearchException: In handler 'savedsearch': Error while dispatching search

Has anyone else had this? - Any suggestions for a fix?

The script has been running for over 15 hours now and hasn't progressed very much. Does anyone have some runtime stats?

0 Karma

efullman
Path Finder

When the back-fill app crashes it can leave a *.lock. In my experience I was running too many simultaneous searches for the back-fill. When you run less in my case it was five, it runs faster and doesn't crash.

0 Karma

cheganbm
Explorer

I have this very same error while building the backlog for a newly created summary report. This error keeps happening every 5-10minutes.

How can I determine the reason why this keeps occurring?
Thanks

0 Karma

efullman
Path Finder

I've had the same thing happen with a different index.

You've probably figured out that the back fill app crashed.

You should make a check for *.lock file in the log directory under the Web Intelligence App. It probably won't be there in a crash, it usually happens if you close the CLI window.

Then look for the last UTC time that was reported by the app if you still have the data. Put that into the script on the et parameter and start up the script again. You should probably monitor to see if it crashes again.

I don't know what the problem is, just how to treat the symptoms.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...