topic Re: data missing in the index after session log out in Getting Data In

data missing in the index after session log out

DataOrg — Tue, 19 Mar 2019 13:08:17 GMT

I have added data through "ADD Data" after completing and i could able to search data.
But data getting missed or search not able to fetch data once splunk session time out.
1. Bucket space is available (i am able to see last week indexed data and problem occurring for last two days)
2. disk space is available
3. i am not able to see indexed data in the bucket /db path.
4. i could able to see last week indexed data ,which is also added thro "ADD data" and issue happening last two days"

please let me know how to troubleshoot issue further?

Re: data missing in the index after session log out

nickhills — Tue, 19 Mar 2019 13:12:37 GMT

Can you be specific about how you used "ADD Data"?
What is the source of the data (ie what system is generating it) and did you upload a file, or add a monitor?

Re: data missing in the index after session log out

DataOrg — Wed, 20 Mar 2019 09:06:03 GMT

@nickhillscpl its a upload data.
log file is generated by windows machine and events are based on timestamp

Re: data missing in the index after session log out

nickhills — Wed, 20 Mar 2019 09:16:42 GMT

When you upload a file it is not continuously monitored, only what was in the file when you uploaded it will ever be indexed.

I am not sure from your question if this is exactly what you are describing.

If you want Splunk to continuously monitor a file and index any changes, you need to add a "monitor" for it, probably with a Universal forwarder.