topic Searching Index error in Splunk Dev

Searching Index error

agom390 — Sun, 10 Jan 2021 21:07:34 GMT

I have been attempting to search my index on my linux vm. I have already added the data files associated with the corresponding index, however, when I go to search the index it keeps giving me an error of no events. Once I add the data again, it will find events but it will only last for one search. I'm not sure how to fix this error, I have followed all instructions on how to install indexes and the data but it's still not working.

Re: Searching Index error

richgalloway — Mon, 11 Jan 2021 14:19:47 GMT

Check the time picker against the time of the events you added. It's possible the data is too old for the selected time window.

Re: Searching Index error

agom390 — Sun, 31 Jan 2021 17:57:55 GMT

I used the time picker for all time and it still doesn't show.

Re: Searching Index error

isoutamo — Mon, 01 Feb 2021 07:32:15 GMT

Try to use index=* on your query if it's in some other index than you are expecting.

One other issue could be that you haven't right to index where data is stored? Based on your question this is not an issue at this time (as you have seen some data).

Splunk's default is show newest events first in your query. If you want another order you must use sort.
r. Ismo