Getting Data In

How to check if the indexer has indexed my data or not ?

joydeep741
Path Finder

I recently did a splunk confugiration. When I do a "splunk list monitor" on the forwarder , I see the logs are getting monitored.
But when query the serach head, I dont see them appearing.

How to check if the indexer has indexed my data or not ?

0 Karma
1 Solution

gokadroid
Motivator

If you have no reason to assume either your search is missing some keywords with which you are searching, or time duration is improper and really want to have a peek at data; go to the Splunk installation folder of the index and data should be present in "indexed" format:

$SPLUNK_HOME\var\lib\splunk\<indexName>\db\<bucketName>\rawdata\journal.gz

Basically for each index one should be able to find the data here in the "indexed" format:

$SPLUNK_HOME\var\lib\splunk\<indexName>\db\*

View solution in original post

0 Karma

woodcock
Esteemed Legend

To see (evidence of) events indexed in the last 5 minutes, do this:

| tstats max(_time) values(sourcetype) max(_indextime) WHERE (index=* OR index=_*) AND _index_earliest=-5m BY host

nmclaughl1
Explorer

Thanks for jumping on this Woodcock! Tried it, _index_time (& index_time & _indextime) doesn't seem to be a field on my 6.6.3 SplunkCloud SH.

0 Karma

woodcock
Esteemed Legend

I had 2 mistakes but I re-edited my original answer and this time I tested it! Try it now.

0 Karma

gokadroid
Motivator

If you have no reason to assume either your search is missing some keywords with which you are searching, or time duration is improper and really want to have a peek at data; go to the Splunk installation folder of the index and data should be present in "indexed" format:

$SPLUNK_HOME\var\lib\splunk\<indexName>\db\<bucketName>\rawdata\journal.gz

Basically for each index one should be able to find the data here in the "indexed" format:

$SPLUNK_HOME\var\lib\splunk\<indexName>\db\*
0 Karma

nmclaughl1
Explorer

Is there a method for SplunkCloud indexing (i.e., no filesystem access) ?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...