https://community.splunk.com/t5/Getting-Data-In/How-can-I-confirm-if-missing-but-previously-indexed-data-has/m-p/74671#M15248 <P>Here's the basic search :<BR /> index=_internal "Moving db"</P> <P>Apply the filters you want to make the search more precise and you should be ok.</P> Fri, 15 Jun 2012 13:09:25 GMT Mahieu 2012-06-15T13:09:25Z https://community.splunk.com/t5/Getting-Data-In/How-can-I-confirm-if-missing-but-previously-indexed-data-has/m-p/74669#M15246 <P>How can I confirm if missing, but previously indexed data has been rolled out or deleted on my behalf <span class="lia-unicode-emoji" title=":disappointed_face:">😞</span> ?</P> <P>I have older data that is known to be previously indexed that is now MIA. Is there an internal log I can view? Keywords? </P> Wed, 13 Jun 2012 23:59:13 GMT https://community.splunk.com/t5/Getting-Data-In/How-can-I-confirm-if-missing-but-previously-indexed-data-has/m-p/74669#M15246 tylr 2012-06-13T23:59:13Z https://community.splunk.com/t5/Getting-Data-In/How-can-I-confirm-if-missing-but-previously-indexed-data-has/m-p/74670#M15247 <P>the splunkd.log should indicate when buckets are rolled.</P> Thu, 14 Jun 2012 05:04:31 GMT https://community.splunk.com/t5/Getting-Data-In/How-can-I-confirm-if-missing-but-previously-indexed-data-has/m-p/74670#M15247 gkanapathy 2012-06-14T05:04:31Z https://community.splunk.com/t5/Getting-Data-In/How-can-I-confirm-if-missing-but-previously-indexed-data-has/m-p/74671#M15248 <P>Here's the basic search :<BR /> index=_internal "Moving db"</P> <P>Apply the filters you want to make the search more precise and you should be ok.</P> Fri, 15 Jun 2012 13:09:25 GMT https://community.splunk.com/t5/Getting-Data-In/How-can-I-confirm-if-missing-but-previously-indexed-data-has/m-p/74671#M15248 Mahieu 2012-06-15T13:09:25Z