topic Re: Indexing issue in Getting Data In

Indexing issue- Why is data going on and off?

ssuluguri — Wed, 12 Jul 2023 20:57:20 GMT

Hi Team,

We are ingesting data from syslot to splunk using Cyberark App . Data is going ON and OFF even though data available on /var/log/Cyberark .

Can you suggest what can be the issue .

Re: Indexing issue

meetmshah — Wed, 12 Jul 2023 19:04:58 GMT

Hello @ssuluguri, Can you please confirm below -

How the _time is being extracted? If it's based on events - can you validate if the timestamp extraction is performed correctly?
Can you check queues on the indexers?
Can you run the search on real-time in Splunk along with running tcpdump on the host and validate if both are matching?

Re: Indexing issue

ssuluguri — Wed, 12 Jul 2023 19:09:16 GMT

Thanks for the reply Meet.

1.Data is indexing on cloud

2.Data automatically populating for sometimes and going OFF.

Backend raw data .

Re: Indexing issue

ssuluguri — Wed, 12 Jul 2023 19:16:46 GMT

You can also refer below screenshot.

Re: Indexing issue- Why is data going on and off?

mansisona — Wed, 20 Mar 2024 04:53:06 GMT

I am facing the same issue while using a scripted input. Did you find any ways to identify the root cause and fix it ? We are receiving data from a scripted input. we also tried putting that data in a csv file which has all the data. but still we are observing issues with data missing