Splunk Dev

can't see all the event of an index anymore

splunkLPN
Path Finder

If I search | eventcount summarize=false index=index3 the answer is count : 32339388
If I search index=index3 182154 event events are count with empty days 42 days before the last days.

I've made 2 changes before to have this behavior :

  • upgrade to 7.1
  • go from a free license to a dev licence on my lab machine.

of course i'm on "all-time" period (or hope to be, because it's look like I'm not)

thank's for your help 🙂

Tags (2)
0 Karma
1 Solution

splunkLPN
Path Finder

OK I've found the limit : "Search auto-finalized after disk usage limit (0MB) reached. "

View solution in original post

0 Karma

splunkLPN
Path Finder

OK I've found the limit : "Search auto-finalized after disk usage limit (0MB) reached. "

0 Karma

p_gurav
Champion

Did you run both the query for all time?

0 Karma

splunkLPN
Path Finder

Thank's. Yes. I did it with the web interface. Is there a SPL command to include all time period ?

0 Karma

skoelpin
SplunkTrust
SplunkTrust
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...