Splunk Search

fill_summary_index.py how to locate and run this script in splunks file directory

dirkbaumann
Explorer

Hi together,
I have found the following fill_summray_index.py script under: http://wiki.splunk.com/Community:Summary_Indexing_Back_Fill
I have customized it and now I have 2 questions:
Where do I locate the script?
How do I run the script?

Tags (1)
0 Karma

jhupka
Path Finder

Are you running this on a unix server? I'll assume so, mainly because that is what I am familiar with - if it is Windows then I am not so sure. The script doesn't have to be anywhere special, you just need access to the splunk and python commands via your path.

You should be the user that the splunk application is installed as (so log in as that user, sudo to it, etc), and the splunk command should be in your path (i.e. the one installed in [SPLUNK_HOME]/bin/). Finally, python should be in your path, too - chances are they python you will be using is in [SPLUNK_HOME]/bin/ as well.

You can check from the command line where splunk and python are by doing:

which splunk
which python

Both of those should return you the path where those are. Now you can run the script from any location you want - all the script does is iteratively invoke the splunk CLI with your search for the interval/time-range you modified the script to be in. That would be something like the following command:

python mySummaryScript.py

One suggestion if you haven't done it already - create another copy of your script that only summarizes 3 or 4 intervals over a smaller time range. Then have the script just dump this into index=summary. Run that one first, wait a few minutes for the summary data to show up, and then verify in index=summary that things look good before running your full script that populates your real summary index. This way you don't inadvertently put in bad data to your real summary if you have a typo.

Get Updates on the Splunk Community!

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...