Splunk Search

Results only showing up in realtime

andrew_rush
New Member

We've just added a new index and under the manager menus it shows that there are events and data in the index. When we run a realtime search, we can see the results as the come in but only those generated after the search was started. And when we do just a normal time frame search there are no results at all.

We are using a Universal forwarder, v5.0.3 and the indexer is v5.0.3

Has anyone seen this issue before? All the conf files look similar to existing forwarders.

0 Karma

LukeMurphey
Champion

Check the timestamps. A real-time search with no time defined (all-time) will show all events as they come in regardless of the time field. This can find events whose times are off. Take a look at the _indextime field and compare it with the _time field to see if the events have an extracted time that is incorrect. These fields are hidden so you have to use eval to get them to display. Below is an example search that creates a delay field containing the difference between the index time and extracted time (in seconds):

| eval indextime=_indextime | eval time=_time | eval delay=indextime-time

The delay field should be a small positive number. If it is negative, then the event has a timestamp in the future.

linu1988
Champion

So are you suggesting they are not indexed?

Other scenario is like , you could see the events in realtime, but the indexed event may have a different timestamp than the actual event time. Search for for the whole data, check if the data which you saw in the rt search are present or not...

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...