https://community.splunk.com/t5/Splunk-Enterprise/Indexed-data-vanishes-after-few-hours-and-cause-0-events-for-2-3/m-p/472263#M9646 <P>I have a Clustered environment and monitoring setup for application logs,universal forwarders push data to indexers .<BR /> Lately , I have been facing issue where the application logs are getting indexed and available .<BR /> But after few hours when I search for the present day logs on splunk there are 0 events for 2 3 hours time frame and indexed data vanishes.</P> <P>Not sure if this is a known issue , any help would be of much help.<BR /> Thanks </P> Fri, 14 Feb 2020 12:22:44 GMT Sujithkumarkb 2020-02-14T12:22:44Z https://community.splunk.com/t5/Splunk-Enterprise/Indexed-data-vanishes-after-few-hours-and-cause-0-events-for-2-3/m-p/472263#M9646 <P>I have a Clustered environment and monitoring setup for application logs,universal forwarders push data to indexers .<BR /> Lately , I have been facing issue where the application logs are getting indexed and available .<BR /> But after few hours when I search for the present day logs on splunk there are 0 events for 2 3 hours time frame and indexed data vanishes.</P> <P>Not sure if this is a known issue , any help would be of much help.<BR /> Thanks </P> Fri, 14 Feb 2020 12:22:44 GMT https://community.splunk.com/t5/Splunk-Enterprise/Indexed-data-vanishes-after-few-hours-and-cause-0-events-for-2-3/m-p/472263#M9646 Sujithkumarkb 2020-02-14T12:22:44Z