How to capture older data through Summary Index Populating Search?

If I have a summary-populating-index search that is scheduled to run daily. Is it possible to index data that is older than a day & goes back about a year through this search?

Thanks for your help.

Ranga

asked 06 May '10, 17:33

sranga
105●11
accept rate: 0%

2 Answers:

oldest newest most voted

You can use the backfilling tool:

http://www.splunk.com/base/Documentation/latest/Knowledge/Managesummaryindexgapsandoverlaps

The script will run searches over the appropriate time range and will back fill the summary index.

link

answered 06 May '10, 17:41

Simeon ♦
3.7k●5●6●27
accept rate: 26%

2	Splunk ships with a script, fill_summary_index.py, that does this for you. link answered 06 May '10, 17:42 the_wolverine ♦ 4.3k●5●8●43 accept rate: 50%

Post your answer

toggle preview

Follow this question

Email:

RSS:

Answers

Answers + Comments

Markdown Basics

*italic* or _italic_
**bold** or __bold__
link:[text](http://url.com/ "Title")
image?![alt text](/path/img.jpg "Title")
numbered list: 1. Foo 2. Bar
to add a line break simply add two spaces to where you would like the new line to be.
basic HTML tags are also supported

learn more about Markdown

Tags:

search ×1,083
savedsearch ×197
summary-index ×150
summary ×46

Asked: 06 May '10, 17:33

Seen: 1,421 times

Last updated: 06 May '10, 17:42

How to capture older data through Summary Index Populating Search?

Follow this question

Splunk Resources

Related questions