I have tried multiple time ranges. no luck.
Cisco app shows data coming in.
License section of Splunk Utilization Monitor app shows data coming in.
Just do not seem to be able to look at raw data.
If you just search *
, you'd get data for the Indexes searched by default
set in your role/user profile, which set while creating role. Check if there was default index assigned to your user role.
http://docs.splunk.com/Documentation/Splunk/6.3.0/Security/Addandeditroles#Add_or_edit_a_role
BTW, you should specify an index, and possibly other filters, for better search performance.
Thanks. We do specify indexes by user. However all indexes go removed for admin. Wonder which admin changed that?
Try this:
index=*
And make sure that you have set your search mode to verbose
.