topic Re: Splunk internal search in Splunk Enterprise

Splunk internal search

uagraw01 — Thu, 02 Nov 2023 10:34:33 GMT

Hello Splunkers!!

I am not getting any data in the internal index for the last 24 hours. Please let me know what will the cause behind it & what i need to check.

ITWhisperer — Thu, 02 Nov 2023 10:37:36 GMT

Does your role have permissions to read the _internal index? Has this ever worked?

isoutamo — Thu, 02 Nov 2023 10:47:48 GMT

Are you sure that you have access to _internal index? You could check it by

Just look what you have on allowed and disallowed rows.

r. Ismo

uagraw01 — Thu, 02 Nov 2023 10:57:30 GMT

@ITWhisperer Yes, that why I specify last 24 hours

uagraw01 — Thu, 02 Nov 2023 10:59:15 GMT

@isoutamo I can access it; I have admin access. I can see logs within 24 hours. But not for the last 24 hours.

isoutamo — Thu, 02 Nov 2023 11:03:03 GMT

Have you enough disk space for
1) creating those logs into disk
2) indexing those to _internal

uagraw01 — Thu, 02 Nov 2023 11:08:19 GMT

@isoutamo We have good storage for Splunk db.