- Splunk Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: Data indexed but not displayed in Search in sp...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Data indexed but not displayed in Search in splunk enterprise
Hi Team,
I have successfully indexed the data but it is not getting displayed in Search, don't know what has gone wrong. Its a file-upload(one time indexing) type of data input configuration and i have created a new index for that particular file and a new sourcetype also.
I could able to see the logs while configuring the event breaking and timestamp format, but when i am searching for that particular index and sourcetype , i couldnt able to find any logs in the search head.
Kindly help me to identify the issue.
Its seems like a strange issue as iam experiencing it in even after two times reinstallation of splunk enterprise in my linux testing server.
Note: iam not experiencing this issue in any of the another linux server.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You could run a metadata search to see what time stamp is on the earliest and latest event.
| metadata type=sourcetype index=*
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I would be checking index _internal for messages showing how much data was indexed. If it doesn't show it, then it wasn't indexed. If it does show it, then you will be able to see WHERE it was indexed.
One possibility is that the user account you are using does not happen to have security access to that index.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
@samsingnok52, would it be possible to give couple of mocked up rows from your file that you are trying to index. Please ensure to Anonymize/Mock any sensitive information. Also if possible the props.conf that you currently have.
Also have you checked index whether there are any events present. You can also use eventcount, tstats, dbinspect or metadata commands for this.
| makeresults | eval message= "Happy Splunking!!!"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi Niket,
Thanks for your comments.I will try and revert back.
As of now , I have reinstalled the splunk enterprise and trying from the scratch.....
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Try expanding the time window to All Time. That will account for possible timestamp problems causing events to be indexed in the "future".
If this reply helps you, Karma would be appreciated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
i did searched for all time, but still couldnt able to find anything
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
searching "all time" is "everthing in the past till NOW".
You need to select the date in the future, like @d+10y
Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!
They're back! Join the SplunkTrust and MVP at .conf24
Enterprise Security Content Update (ESCU) | New Releases
