Splunk Search

Data vanished from search

Kindred
Path Finder

Hey,

We have a 20GB index that is showing an earliest date of 27th Dec 2013. The current size of the index is about 19.995GB, so this leads me to believe it is full and rolling data for deletion, with the earliest entry still being over 3 months ago.

However, when I search for events from last month (say 1st Feb) I don't see any data at all.

What could have caused the data to be removed from search, given the index thinks its has data going back 3 months?

How can I verify the current retention time? I have a feeling the earliest date reference in the index configuration page is lying to me.

Tags (3)
0 Karma

bshuler_splunk
Splunk Employee
Splunk Employee

Odds are you search is bad. When I am not seeing what I expect, I eliminate constraints until I see the data. Most times I added a constraint without understanding it fully. I would try a search like this:

index=main | stats min(_time) as time | eval time=strftime(time, "%H:%M:%S %m-%d-%y")

over all time, and see what I get.

0 Karma

Kindred
Path Finder

I have literally just specified index=myindex and set the custom timeframe.

I have a feeling the "earliest date" column in the index configuration is lying to me, and it is actually rolling over faster than I thought.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...