topic Re: Why does my sample data not show up in search after using the "Add Data" function? in Getting Data In

Why does my sample data not show up in search after using the "Add Data" function?

dbcase — Tue, 16 May 2017 16:53:51 GMT

Hi,

I have the below data that I'm trying to import into Splunk. Right now I'm working with a sample file only 10 entries long. Below is a snippet. I'm using the "Add Data" function and using the default source type and putting the data into a brand new index and when I go to search, there are 0 results. Thoughts?

"Premise"="1000190" "Type"="doorLock" "SensorId"="000d6f0000e95c62.1 " "Label"="Door Lock" "Manufacturer"="Yale" "Model"="YRD220/240 TSDB" "Firmware version"="0x00840850" "Hardware version"="17" "UserProperty.NearEndRssi"="-50" "UserProperty.pim.batteryLow"="false" "UserProperty.NearEndLqi"="255" "UserProperty.label"="Door Lock" "UserProperty.deadboltJammed"="false" "Battery Operated"="True" "Voltage"="N/A" "FE radio"="NA/NA" "NE radio"="-50/255" "Date added"="Thu Aug 25 17:24:39 CDT 2016" "Date of last communication"="Tue May 16 11:06:51 CDT 2017" "In Communication Failure"="false" "In firmware upgrade failure"="false" "Firmware upgrade available"="false" "Is Locked"="true" "Max Users"="250" Operation Mode="normal"
"Premise"="1000190" "Type"="sensor" "SensorId"="000d6f000babf653.1 " "Label"="Ecolink Door" "Manufacturer"="Ecolink" "Model"="4655BC0-R" "Firmware version"="0x20160921" "Hardware version"="1" "UserProperty.Zone.ZoneType"="1" "UserProperty.NearEndRssi"="-34" "UserProperty.NearEndLqi"="255" "UserProperty.IASZoneStatus"="32" "UserProperty.Zone.ZoneNumber"="27" "UserProperty.orderIndex"="8" "UserProperty.Zone.SwingerShutdown"="false" "UserProperty.Zone.TestMode"="false" "UserProperty.Zone.Edited"="true" "UserProperty.label"="Ecolink Door" "UserProperty.Zone.FunctionType"="7" "UserProperty.Zone.Bypassed"="false" "UserProperty.Zone.SensorId"="25" "Battery Operated"="True" "Voltage"="2.9V" "FE radio"="-27/255" "NE radio"="-34/255" "Date added"="Mon Mar 20 20:37:02 CDT 2017" "Date of last communication"="Tue May 16 11:04:51 CDT 2017" "In Communication Failure"="false" "In firmware upgrade failure"="false" "Firmware upgrade available"="false" "Sensor Status"="SensorStatus [faulted=false; tampered=false; lowBattery=false; trouble=false; ACMainsFault=false]" "Sensor Type"="SensorTypeContactSwitch" "Is Sensor Type Configurable"="false" "Is Security Sensor"="true" Temperature="25.0C"
"Premise"="1000190" "Type"="sensor" "SensorId"="000d6f000b5c9db5.1 " "Label"="New Motion" "Manufacturer"="Universal Electronics Inc" "Model"="URC4470BC0-X-R" "Firmware version"="0x040f0544" "Hardware version"="5" "UserProperty.Zone.ZoneType"="3" "UserProperty.NearEndRssi"="-33" "UserProperty.NearEndLqi"="255" "UserProperty.IASZoneStatus"="32" "UserProperty.Zone.ZoneNumber"="25" "UserProperty.orderIndex"="6" "UserProperty.Zone.SwingerShutdown"="false" "UserProperty.Zone.TestMode"="false" "UserProperty.Zone.Edited"="true" "UserProperty.label"="New Motion" "UserProperty.Zone.FunctionType"="10" "UserProperty.Zone.Bypassed"="false" "UserProperty.Zone.SensorId"="23" "Battery Operated"="True" "Voltage"="2.9V" "FE radio"="-27/255" "NE radio"="-33/255" "Date added"="Sat Mar 11 17:33:22 CST 2017" "Date of last communication"="Tue May 16 10:52:53 CDT 2017" "In Communication Failure"="false" "In firmware upgrade failure"="false" "Firmware upgrade available"="false" "Sensor Status"="SensorStatus [faulted=false; tampered=false; lowBattery=false; trouble=false; ACMainsFault=false]" "Sensor Type"="SensorTypeMotion" "Is Sensor Type Configurable"="false" "Is Security Sensor"="true" Temperature="24.98C"
"Premise"="1000190" "Type"="sensor" "SensorId"="001e5e09021a3e84.1 " "Label"="Button" "Manufacturer"="SALUS" "Model"="SS883ZB" "Firmware version"="0x20160721" "Hardware version"="1" "UserProperty.Zone.ZoneType"="1" "UserProperty.NearEndRssi"="-35" "UserProperty.NearEndLqi"="255" "UserProperty.IASZoneStatus"="32" "UserProperty.Zone.ZoneNumber"="19" "UserProperty.orderIndex"="2" "UserProperty.Zone.SwingerShutdown"="false" "UserProperty.Zone.TestMode"="false" "UserProperty.Zone.Edited"="true" "UserProperty.label"="Button" "UserProperty.Zone.FunctionType"="5" "UserProperty.Zone.Bypassed"="false" "UserProperty.Zone.SensorId"="17" "Battery Operated"="True" "Voltage"="3.1V" "FE radio"="-27/255" "NE radio"="-35/255" "Date added"="Mon Sep 26 19:28:12 CDT 2016" "Date of last communication"="Tue May 16 11:00:48 CDT 2017" "In Communication Failure"="false" "In firmware upgrade failure"="false" "Firmware upgrade available"="false" "Sensor Status"="SensorStatus [faulted=false; tampered=false; lowBattery=false; trouble=false; ACMainsFault=false]" "Sensor Type"="SensorTypeContactSwitch" "Is Sensor Type Configurable"="false" "Is Security Sensor"="true" Temperature="25.5C"

Re: Why does my sample data not show up in search after using the "Add Data" function?

rphillips_splk — Tue, 16 May 2017 17:07:58 GMT

@dbcase some things to check:

1.) does the index exist at the indexer or instance you've ingested the sample data to? If not, create it in indexes.conf

2.) does your search include the index name in the search query (ie: index=new_index ....) ? If not, include that in your search as the new index is likely not in the list of indexes searched by default (if you do not include the index name in your search query)

3.) does the role your user belong to have access to search this index? Check via >Settings>Access controls » Roles »

Indexes
Indexes searched by default

4.) do you see results if you search just that index ? Perhaps the source value needs to be adjusted (ie: source=*sourcelog.log*) to match your source file

Re: Why does my sample data not show up in search after using the "Add Data" function?

dbcase — Tue, 16 May 2017 17:16:32 GMT

Hi Phillips,

On #1. Yes sir, double checked

2. yes, and the date range is all time

3. yes, I'm admin

4. I searched with and without a source type same results

Re: Why does my sample data not show up in search after using the "Add Data" function?

rphillips_splk — Tue, 16 May 2017 17:23:38 GMT

is this a standalone instance or distributed deployment? Can you paste the search you are using

Re: Why does my sample data not show up in search after using the "Add Data" function?

dbcase — Tue, 16 May 2017 19:07:20 GMT

It is a Splunk Cloud instance.

The search string is pretty simple (see below). I've tried it with and without the source type and quotes, no luck

index="dancalderwood" sourcetype=dan2

Re: Why does my sample data not show up in search after using the "Add Data" function?

DalJeanis — Tue, 16 May 2017 20:30:33 GMT

try index=* "0x00840850" and see if anything comes up. That would indicate if the events got rerouted somewhere else, and would show you where.

Re: Why does my sample data not show up in search after using the "Add Data" function?

dbcase — Tue, 16 May 2017 21:19:10 GMT

Hi Dal Jeanis,

Thats a great idea! It "worked" by showing me that the data is simply not there even though Splunk indicates that it was imported. Something is amiss somewhere but I dunno where.

Re: Why does my sample data not show up in search after using the "Add Data" function?

DalJeanis — Fri, 06 Oct 2017 20:23:09 GMT

@dbcase - did you ever find your missing events?