topic Data not getting retrieved after indexing in Getting Data In

Data not getting retrieved after indexing

abhayneilam — Mon, 28 Sep 2020 12:36:45 GMT

Hi,

I am importing the data through the inputs.conf file :

[default]
host = XXXXXXXXXX
[monitor://C:\Users\lg133108\Desktop\NEW_TEST]
disabled = false
crcSalt=<SOURCE>
index = upload_data_new
sourcetype = mysource_new

when I am going to search for my data :

index="upload_data_new" , I am seeing 0 events ..please suggest me how to resolve this problem.

Please help !!

Thanks
Abhay

Re: Data not getting retrieved after indexing

sowings — Thu, 11 Oct 2012 17:03:04 GMT

Check your time range? If you're indexing historical data, the time range might not include those events.

Does the index exist? Splunk won't create it for you, based on inputs.conf alone; you have to create the index first.

Re: Data not getting retrieved after indexing

abhayneilam — Thu, 11 Oct 2012 17:35:31 GMT

I have given the time range as "All time", yes ofcourse my data is historical data.

I created the index first then configured the inputs.conf and restarted the system..

Please help me in this regards,

Thanks,
Abhay

Re: Data not getting retrieved after indexing

SplunkUser5888 — Wed, 17 Oct 2012 14:43:25 GMT

I've noticed Splunk can be really picky when it comes to search.
This may be silly but what do you get if you try

host=xxxxxxxx index=upload_date_new sourcetype=mysource_new

All Time

Re: Data not getting retrieved after indexing

SplunkUser5888 — Wed, 17 Oct 2012 14:45:13 GMT

I've had issues with search and noticed that sometimes I won't get any results unless i type the whole shabang. I guess its pickiness is what makes it so intuitive once you get to a higher level :S