topic Re: I can't see my data in Security

I can't see my data

Yann_T — Thu, 10 Apr 2014 09:55:43 GMT

I have installed splunk with an smtp apps.
While a few moments everythings was ok.
But since 7 days I can't see my data. The only thing I did was activate my new lincense. But it was about 6 days before today.
My data are stored in a specific index but I'm far from the max size limit.
What could be happened ?

Re: I can't see my data

grijhwani — Thu, 10 Apr 2014 10:54:30 GMT

You probably need to provide more detail of the search you are using.

Re: I can't see my data

grijhwani — Mon, 28 Sep 2020 16:21:26 GMT

What platform are you running on? (Windows, version/Linux, distro)

What is the search string you are using?

What do you see in ${SPLUNK_HOME}/var/log/splunk/splunkd.log and ${SPLUNK_HOME}/var/log/splunk/web_access.log

Checking your licence (or license if you are American), are the details correct?
Manager -> Licensing

Re: I can't see my data

martin_mueller — Thu, 10 Apr 2014 13:02:05 GMT

Grab a copy of the SoS app for debugging: http://apps.splunk.com/app/748/

Re: I can't see my data

Yann_T — Mon, 28 Sep 2020 16:21:29 GMT

I am running a linux platform "centOs 6"

I just used "*" as search string in last 24 hours.

On the start page of my own apps I can see 2,527,605 Events INDEXED and LATEST EVENT : 7 days ago.

In my splunkd.log I have some errors notified many times

splunkd.log :

03-26-2014 13:07:38.038 +0100 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/snmp_ta/bin/snmp.py" No SNMP response received before timeout snmp_stanza:snmp://snmp_user_ssid snmp_destination:10.1.1.250 snmp_port:161

03-27-2014 11:06:14.625 +0100 WARN ExecProcessor - Streaming XML data: Received an event with missing or empty "data" tag.

03-27-2014 12:09:41.981 +0100 ERROR databasePartitionPolicy - insufficient privileges to perform this operation
03-27-2014 12:09:42.588 +0100 ERROR StreamingDeleteOperator - Error in 'delete' command: You have insufficient privileges to delete events.

04-09-2014 23:23:11.925 +0200 WARN DateParserVerbose - A possible timestamp match (Tue May 10 10:20:57 2005) is outside of the acceptable time window. If this timestamp is correct, consider adjusting MAX_DAYS_AGO and MAX_DAYS_HENCE. Context: source::snmp://userRxData|host::10.1.1.250|logsnmp_userRxData|0

And for my licence all details are correct (I'm french)

Thank you for your help

Re: I can't see my data

Yann_T — Thu, 10 Apr 2014 14:11:47 GMT

I installed SoS app but how can it help me ? I don't see anything wrong at this time.
But I can see some errors in my logs

Re: I can't see my data

martin_mueller — Thu, 10 Apr 2014 14:37:07 GMT

Those errors could be telling you something about what's going wrong.

The beauty of SoS is that you can see at a glance what amount of data is going where at what point in time, without having to crawl through the _internal index yourself.

Re: I can't see my data

Yann_T — Thu, 10 Apr 2014 15:19:18 GMT

I have the ERROR : tcpinputproc : could not bind to port IPV4 port 80

do you know what is it ?

Re: I can't see my data

martin_mueller — Thu, 10 Apr 2014 16:05:04 GMT

Sounds like you're trying to tell Splunk to listen to data coming in on port 80, but binding to that port failed. Common reasons are either lack of permissions due to not being run as root, or already bound ports due to in this case an existing HTTP server.

Re: I can't see my data

Yann_T — Fri, 11 Apr 2014 14:57:42 GMT

how can I see what's going wrong with SoS ? I can see a lot of things but for example I can't see anything in "Warnings and errors"

Re: I can't see my data

martin_mueller — Fri, 11 Apr 2014 15:10:54 GMT

The indexing views can tell you if anything is being indexed, and into what index, to confirm if anything is coming in or not.

Re: I can't see my data

Yann_T — Fri, 11 Apr 2014 15:17:52 GMT

Ok so I can see that I have events in my indexer.
But when I try to catch out them with a simple "*" I don't have anything

Re: I can't see my data

martin_mueller — Fri, 11 Apr 2014 15:19:12 GMT

Add a filter like index=thatindex. Depending on your user's role you're only searching some indexes by default.

Re: I can't see my data

Yann_T — Fri, 11 Apr 2014 15:24:19 GMT

Thank you when I add a filter I have my data. But I always see in the main page LAST EVENT : 8 days ago ?
I don't know why

Re: I can't see my data

martin_mueller — Fri, 11 Apr 2014 15:31:51 GMT

The problem appears to be that your user's role isn't searching the relevant indexes by default - then the display at the start will not see those events.

Edit your user's role to search all non-internal indexes by default if you want to change that, just remember that a search for "foo" will then search through all indexes.

Re: I can't see my data

Yann_T — Thu, 17 Apr 2014 07:39:41 GMT

Thank you a lot

Re: I can't see my data

mycloudsplunk — Wed, 30 Sep 2020 01:21:36 GMT

Can you please tell me how to edit user's role to search all non-internal indexes?
@martin_mueller @Yann_T