Dashboards & Visualizations

After adding data as a text file into Splunk, why are no events shown under the Events tab when running a search?

Navanitha
Path Finder

i have injected certain data into splunk (a text file). While doing a search, it gives me the total number of events matched, but does not show any events under Event tab. All other logs are working fine except this file.

Can someone pls help here

Tags (3)
0 Karma
1 Solution

chimell
Motivator

hi Navanitha
Change the timerange picker and re run the following search index=*

View solution in original post

chimell
Motivator

hi Navanitha
Change the timerange picker and re run the following search index=*

Navanitha
Path Finder

True..but in this case its not working.. 😞

0 Karma

chimell
Motivator

Hi Navanitha
you forgot to vote my answer

0 Karma

chimell
Motivator

Good .......

0 Karma

NOUMSSI
Builder

Hi Navanitha,
All time search should work right because this value of timerange will cover periodes includind periodes that your events have been produced.
So the best way is to use All time

0 Karma

Navanitha
Path Finder

Hi Chimell,

It worked. Thanks. I can see the events now after changing the time range to 'previous year'.

But this is a random text file which I am using for some testing purpose. And it has data of last year. In this case All time search should work right?

0 Karma

gyslainlatsa
Motivator

hi,
you must perform you search in verbose mode.

0 Karma

gyslainlatsa
Motivator

you using what version of the splunk? and what mode of the search? fast mode, smart mode or verbose mode?

0 Karma

Navanitha
Path Finder

6.2.2. I am doing this on a trial version.

0 Karma

gyslainlatsa
Motivator

see the specification below that propose

0 Karma

Navanitha
Path Finder

I am searching it in verbose mode only..any other possibility pls..

0 Karma

gyslainlatsa
Motivator

try to do one query and go check the result

0 Karma

Navanitha
Path Finder

yeah I could see some result for a query search..but still not able to see all the events. I need to extract the fields looking at the events. how do i get it?

0 Karma

gyslainlatsa
Motivator

enter * in the search bar at verbose mode

0 Karma

Navanitha
Path Finder

no luck..when i type index=*, I am able to see all the events one with my source file also. But when i click on my source file, it again says 40events found. but says "no results found" under event tab.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...