https://community.splunk.com/t5/Splunk-Dev/Splunk-Indexed-Data-Mysteriously-Disappears/m-p/73442#M1026 <P>We are periodically seeing instances where data that was previously indexed no longer shows up, leaving "holes" in our index timeline. I did a search on the _internal index for the "delete" keyword and I'm not seeing any delete commands issued. I'm not seeing anything in the _audit index either. So I have two questions: why is this happening, and how do I fill in the gaps where data is missing?</P> Wed, 20 Oct 2010 09:58:51 GMT johnboldt 2010-10-20T09:58:51Z https://community.splunk.com/t5/Splunk-Dev/Splunk-Indexed-Data-Mysteriously-Disappears/m-p/73442#M1026 <P>We are periodically seeing instances where data that was previously indexed no longer shows up, leaving "holes" in our index timeline. I did a search on the _internal index for the "delete" keyword and I'm not seeing any delete commands issued. I'm not seeing anything in the _audit index either. So I have two questions: why is this happening, and how do I fill in the gaps where data is missing?</P> Wed, 20 Oct 2010 09:58:51 GMT https://community.splunk.com/t5/Splunk-Dev/Splunk-Indexed-Data-Mysteriously-Disappears/m-p/73442#M1026 johnboldt 2010-10-20T09:58:51Z https://community.splunk.com/t5/Splunk-Dev/Splunk-Indexed-Data-Mysteriously-Disappears/m-p/73443#M1027 <P>Seems extremely unlikely, unless it happens that you are hitting limits on your index size, and it is simply being naturally rolled out to accommodate newer data.</P> Wed, 20 Oct 2010 10:54:56 GMT https://community.splunk.com/t5/Splunk-Dev/Splunk-Indexed-Data-Mysteriously-Disappears/m-p/73443#M1027 gkanapathy 2010-10-20T10:54:56Z