topic Re: Search Help in Splunk Search

Search Help

mkhatri — Mon, 12 Jul 2021 15:12:38 GMT

Hello , I am trying to get the sales report for 3 months but the search results only gives the result for last 15 days. Results before 15 days are all zeros. the job notification shows :

[pdx-nav-non-prod-splunk-idx-240-132] Your search has been restricted to a time span of 1296000 seconds. i.e. 15 days.

So my question is how can i get the full report for 3 months or how can i increase the time span of a search .

Re: Search Help

michel_wolf — Mon, 12 Jul 2021 15:18:44 GMT

Hi,

I think you need to ask your splunk admin, maybe you have some role restrictions here like:

Re: Search Help

gcusello — Mon, 12 Jul 2021 15:20:35 GMT

Hi @mkhatri,

what's the retention of the index containing those data?

maybe you have on that index a retention of 15 days.

In addition, could you share the search you're using?

Ciao.

Giuseppe

Re: Search Help

mkhatri — Mon, 12 Jul 2021 15:37:55 GMT

Hii , i am not able to see the index on my splunk settings. The search i am using is :

index=nav_app_message_gateway event=sentMessageTo* status=200 | timechart count by templateId

Re: Search Help

mkhatri — Mon, 12 Jul 2021 15:51:31 GMT

Yes .Maybe that's why i didn't have index on my splunk settings. Thank you @michel_wolf .