I recently did a splunk confugiration. When I do a "splunk list monitor" on the forwarder , I see the logs are getting monitored.
But when query the serach head, I dont see them appearing.
How to check if the indexer has indexed my data or not ?
If you have no reason to assume either your search is missing some keywords with which you are searching, or time duration is improper and really want to have a peek at data; go to the Splunk installation folder of the index and data should be present in "indexed" format:
$SPLUNK_HOME\var\lib\splunk\<indexName>\db\<bucketName>\rawdata\journal.gz
Basically for each index one should be able to find the data here in the "indexed" format:
$SPLUNK_HOME\var\lib\splunk\<indexName>\db\*
To see (evidence of) events indexed in the last 5 minutes, do this:
| tstats max(_time) values(sourcetype) max(_indextime) WHERE (index=* OR index=_*) AND _index_earliest=-5m BY host
Thanks for jumping on this Woodcock! Tried it, _index_time (& index_time & _indextime) doesn't seem to be a field on my 6.6.3 SplunkCloud SH.
I had 2 mistakes but I re-edited my original answer and this time I tested it! Try it now.
If you have no reason to assume either your search is missing some keywords with which you are searching, or time duration is improper and really want to have a peek at data; go to the Splunk installation folder of the index and data should be present in "indexed" format:
$SPLUNK_HOME\var\lib\splunk\<indexName>\db\<bucketName>\rawdata\journal.gz
Basically for each index one should be able to find the data here in the "indexed" format:
$SPLUNK_HOME\var\lib\splunk\<indexName>\db\*
Is there a method for SplunkCloud indexing (i.e., no filesystem access) ?