https://community.splunk.com/t5/Monitoring-Splunk/Abruptly-missing-old-data/m-p/506906#M4307 <P>We have been collecting syslog data on our hosts for the past 5 years or so. Syslog is in our 'main' index, along with other events.&nbsp; We performed a query today and noticed that all of our data in 'main', and a few other indexes, prior to late-2018 are gone. *poof*&nbsp; &nbsp;Looking at our monitoring graphs, it looks like our disk space usage plummeted back in March, which is probably when this happened.&nbsp;</P><P>I have no idea where the data went. The time of the drop in disk usage does not correspond to any upgrade or maintenance during that period.&nbsp;</P><P>Can anyone offer suggestions on how to troubleshoot this? Is it possible that, for some reason, Splunk rolled it over to frozen? I'm grasping. Any suggestions would be appreciated.&nbsp;</P><P>Thanks!</P> Wed, 01 Jul 2020 16:53:20 GMT bloizides 2020-07-01T16:53:20Z https://community.splunk.com/t5/Monitoring-Splunk/Abruptly-missing-old-data/m-p/506906#M4307 <P>We have been collecting syslog data on our hosts for the past 5 years or so. Syslog is in our 'main' index, along with other events.&nbsp; We performed a query today and noticed that all of our data in 'main', and a few other indexes, prior to late-2018 are gone. *poof*&nbsp; &nbsp;Looking at our monitoring graphs, it looks like our disk space usage plummeted back in March, which is probably when this happened.&nbsp;</P><P>I have no idea where the data went. The time of the drop in disk usage does not correspond to any upgrade or maintenance during that period.&nbsp;</P><P>Can anyone offer suggestions on how to troubleshoot this? Is it possible that, for some reason, Splunk rolled it over to frozen? I'm grasping. Any suggestions would be appreciated.&nbsp;</P><P>Thanks!</P> Wed, 01 Jul 2020 16:53:20 GMT https://community.splunk.com/t5/Monitoring-Splunk/Abruptly-missing-old-data/m-p/506906#M4307 bloizides 2020-07-01T16:53:20Z