Splunk Search

indexed data missing for source type

kteng2024
Path Finder

Data already been indexed for a sourcetype is missing in splunk . Can i please know how to troubleshoot the issue . events in splunk in splunk are missing for only those 2 days but events are available before and after those 2 days.

0 Karma

mattymo
Splunk Employee
Splunk Employee

Have you searched all time? Sounds like timestamp issues...

- MattyMo
0 Karma

kteng2024
Path Finder

no timestamp change.

0 Karma

mattymo
Splunk Employee
Splunk Employee

what is the date of the missing data?
Is the sourcetype looking ok real time?
what is the source and sourcetype of the data. how is it collected?
Are you an admin?
Is it possible it is collected in daily files and rolled over, and somehow those two days were lost, or need to be re-indexed?

#hunt for the source file, may show you exactly where to find the raw data, if meta is not overwritten
    index=<yourIndex> sourcetype=<yourSourcetype> | stats count by source | head 10000

#Look at the configuration for the particular sourcetype. 
    ./splunk btool inputs list <yourInput>  --debug
    ./splunk btool props list  <yourSourcetype> --debug


#if you get to the point you are chasing buckets
    check out | db inspect
- MattyMo
0 Karma

hardikJsheth
Motivator

The reason why data is missing will depend on how its getting indexed

If you are monitoring a file which is managed via logrotation, then problem can be with the filechecksum. Splunk may have already indexed data from the beginning of the file and file was rotated which may have resulted in data not getting indexed from rest of the file.

0 Karma
Get Updates on the Splunk Community!

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...

Share Your Ideas & Meet the Lantern team at .Conf! Plus All of This Month’s New ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...