Splunk Fundamentals 1 - Lab 4 - Datas not found after indexation

Darkpat60 — Tue, 29 Jun 2021 20:50:16 GMT

Hello,

I follow the Splunk Fundamentals 1 and have installed Splunk 8.2.1 as a local instance (Windows 10). The lab 4 material is composed of 3 files that have to be uploaded on splunk in an admin session. I follow the instructions and that seems to be working ok, but I don't see the indexed datas neither on the admin or power session after.

I tried to change the time span of the search results, to search in my datasets (empty in both sessions), nothing appears. I reuploaded the material and while saving a cvs file it seems the file was already there (from the first upload). But again, no results and no datas appear to have been indexed/ingested into splunk after.

Has anyone any idea to fix that or ever encountered this problem? Thanks a lot folks!

Re: Splunk Fundamentals 1 - Lab 4 - Datas not found after indexation

Darkpat60 — Tue, 29 Jun 2021 21:11:09 GMT

Ok sorry to spam, I kind of found the datas, they appear by clicking the "create a table view" and selecting the right index.But It seems that the datas is kind of processed this way, anyway the indexations was working.

So I made a search with an sample IP from the logs and had results with the searchbar. So ok datas are there (even if I don't have a view of the sources and other stats on the logs). Anyway, hope it helps, as the version seems to have changed since the version of fundamentals 1 materials.

topic Re: Splunk Fundamentals 1 - Lab 4 - Datas not found after indexation in Getting Data In

Splunk Fundamentals 1 - Lab 4 - Datas not found after indexation

Re: Splunk Fundamentals 1 - Lab 4 - Datas not found after indexation