topic Re: Inconsistent ingestion in Dashboards & Visualizations

Why am I experiencing inconsistent ingestion?

Slimbanty1 — Tue, 30 Aug 2022 12:47:22 GMT

Hello pls I have a problem with a search.

if I run this search, it has inconsistent ingestion. Here is the search I ran:

index=compare_items

if I put a time range of 60mins even 7days, I do not see results. But if I put 30days, I have like million events populated.

Here is the error message I got from Splunk.:

configuration for xyz/123/xxx/ took longer time than expected. This usually indicate problem with underlying storage performance.

can someone help me if you had similar experience. Thanks

Re: Inconsistent ingestion

isoutamo — Tue, 30 Aug 2022 08:44:20 GMT

probably you have some issues to get data in?
If you have MC, you could check there if there are missing forwarders etc.

Another way is check if that index contains data like

| tstats prestats=t count where index=compare_items by _time, host span=1d | timechart span=1d count by host

Then select different time frame for it. That should show when events has stopped to come into splunk. Then just look from UF (host on previous query) side have there happened anything.

r. Ismo