topic Re: Missing logs in Splunk Enterprise

Missing logs

BRFZ — Fri, 30 Jan 2026 09:43:05 GMT

Hi everyone,

I'm facing an issue on my Splunk environment and I'd like your advice.

After an upgrade, I noticed that I still had to restart/start/stop the Splunk process using sudo (even though before the upgrade it was already running under the correct user : USERX).

To address this, I stopped the Splunk on Indexers (not at the same time) and reassigned Splunk to run under USERX.

After this operation, I realized that one full day of logs is missing.

The issue is that before making this change, I didn't verify whether the logs for that specific day already existed, so I can't say for sure if the gap appeared exactly at that moment.

If anyone has seen something similar or has any ideas, I'd really appreciate your help.

Thank you in advance.

Re: Missing logs

livehybrid — Fri, 30 Jan 2026 10:58:15 GMT

Hi @BRFZ

If youve been periodically running the indexers under a different user then I suppose there is a chance that the permissions on the buckets for that period of time are owned by a user that Splunk running under the other user cannot see.

I would suggest checking the ownership of all buckets to ensure they are owned by the user that Splunk is running as. Typically this would be in $SPLUNK_HOME/var/lib/splunk/<indexName>

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Re: Missing logs

BRFZ — Mon, 02 Feb 2026 08:37:22 GMT

Hi @livehybrid

Thank you for your response. I have verified this point, and the ownership of all buckets is set to the user that Splunk is running as.