https://community.splunk.com/t5/Getting-Data-In/How-do-I-find-an-already-uploaded-file/m-p/379029#M68524 <P>run this command: source=*| stats count by source</P> Wed, 25 Sep 2019 23:00:22 GMT ningwudm00 2019-09-25T23:00:22Z https://community.splunk.com/t5/Getting-Data-In/How-do-I-find-an-already-uploaded-file/m-p/379027#M68522 <P>How do I find an already uploaded file in Splunk and download it to my PC? Is there a particular data store that lists all of the total uploaded files? </P> Mon, 30 Jul 2018 01:39:36 GMT https://community.splunk.com/t5/Getting-Data-In/How-do-I-find-an-already-uploaded-file/m-p/379027#M68522 nathant089 2018-07-30T01:39:36Z https://community.splunk.com/t5/Getting-Data-In/How-do-I-find-an-already-uploaded-file/m-p/379028#M68523 <P>Once ingested into Splunk, incoming data is not retained as "files". It's all squished together into something called a "fishbucket" (or just "bucket").</P> <P>Now, it is possible that the source file may exist somewhere on the computer system, but that's not really a Splunk thing to deal with.</P> <P>You can try to track that down, if it actually exists, by looking at the <CODE>source</CODE> field on the data. If it looks like a file name, then it probably is a file name. </P> <P>Then you can identify, if you have admin rights, where that is getting ingested from, and see if the file is still in that place or whether it has since been archived or deleted. In the case of many types of log files, it may also be rolled to another name, so <CODE>some.log</CODE> when it gets filled up becomes <CODE>some.log.3</CODE> and then a new <CODE>some.log</CODE> is created, which later becomes <CODE>some.log.4</CODE> and eventually it rolls around to reuse <CODE>some.log.3</CODE> again. </P> Mon, 30 Jul 2018 02:38:31 GMT https://community.splunk.com/t5/Getting-Data-In/How-do-I-find-an-already-uploaded-file/m-p/379028#M68523 DalJeanis 2018-07-30T02:38:31Z https://community.splunk.com/t5/Getting-Data-In/How-do-I-find-an-already-uploaded-file/m-p/379029#M68524 <P>run this command: source=*| stats count by source</P> Wed, 25 Sep 2019 23:00:22 GMT https://community.splunk.com/t5/Getting-Data-In/How-do-I-find-an-already-uploaded-file/m-p/379029#M68524 ningwudm00 2019-09-25T23:00:22Z