https://community.splunk.com/t5/Getting-Data-In/How-to-troubleshoot-why-I-m-missing-log-data-in-Splunk-for-one/m-p/230705#M99008 <P>Define "suddenly" please. </P> <P>Does this mean that yesterday you had data for 25/04 and 24/04 but today "suddenly" the data no longer appears?</P> <P>Or does it mean, you have a gap in your data on 25/04 and 24/04 that you didnt notice until today?</P> <P>Possible issues for the 1st scenario:<BR /> -Bad data retirement/retention policy<BR /> -Someone used the |delete command<BR /> -Someone manually erased buckets from the filesystem<BR /> -Filesystem corruption</P> <P>Possible issues for the 2nd scenario:<BR /> -Network was down<BR /> -Forwarders were down<BR /> -Splunk was down<BR /> -Maintenance to mainframe<BR /> -Maintenance to anything between mainframe and splunk indexers<BR /> -etc</P> Wed, 04 May 2016 12:55:44 GMT jkat54 2016-05-04T12:55:44Z https://community.splunk.com/t5/Getting-Data-In/How-to-troubleshoot-why-I-m-missing-log-data-in-Splunk-for-one/m-p/230704#M99007 <P>Hi,</P> <P>I have logs coming into Splunk from our Mainframe server for a long time. I noticed that Splunk is suddenly not showing any logs on 25/04/2016 and there were partial results on 24/04. Although it is working fine now, I still don't see logs for only 25/04. What might be the possibilities for such discrepancies and is there something I need to check on my end?</P> <P>Thank you..</P> Wed, 04 May 2016 09:34:08 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-troubleshoot-why-I-m-missing-log-data-in-Splunk-for-one/m-p/230704#M99007 Navanitha 2016-05-04T09:34:08Z https://community.splunk.com/t5/Getting-Data-In/How-to-troubleshoot-why-I-m-missing-log-data-in-Splunk-for-one/m-p/230705#M99008 <P>Define "suddenly" please. </P> <P>Does this mean that yesterday you had data for 25/04 and 24/04 but today "suddenly" the data no longer appears?</P> <P>Or does it mean, you have a gap in your data on 25/04 and 24/04 that you didnt notice until today?</P> <P>Possible issues for the 1st scenario:<BR /> -Bad data retirement/retention policy<BR /> -Someone used the |delete command<BR /> -Someone manually erased buckets from the filesystem<BR /> -Filesystem corruption</P> <P>Possible issues for the 2nd scenario:<BR /> -Network was down<BR /> -Forwarders were down<BR /> -Splunk was down<BR /> -Maintenance to mainframe<BR /> -Maintenance to anything between mainframe and splunk indexers<BR /> -etc</P> Wed, 04 May 2016 12:55:44 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-troubleshoot-why-I-m-missing-log-data-in-Splunk-for-one/m-p/230705#M99008 jkat54 2016-05-04T12:55:44Z https://community.splunk.com/t5/Getting-Data-In/How-to-troubleshoot-why-I-m-missing-log-data-in-Splunk-for-one/m-p/230706#M99009 <P>it is the second scenario, I have a gap in data for those two dates and till now, I don't see the data coming in for those two days until now.</P> <P>so assuming the forwarder was down/network was down, how can I get the data for those days into Splunk now?</P> Wed, 04 May 2016 13:01:55 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-troubleshoot-why-I-m-missing-log-data-in-Splunk-for-one/m-p/230706#M99009 Navanitha 2016-05-04T13:01:55Z