topic no results found? in Splunk Search

no results found?

TISKAR — Fri, 06 Jan 2017 09:19:35 GMT

Hey Splunkers:

I indexed my data, and I worked quietly, but today I ran the same query, output is : "no results found"

source="lightsaber_bis2.csv" host="PC" index="index3" sourcetype="csv"

Splunk: Splunk Entreprise.

Can you Help please.

Re: no results found?

renjith_nair — Fri, 06 Jan 2017 10:01:54 GMT

Try changing the time range in Splunk search bar.
It's possible that you indexed the data with old timestamps and searching for latest.

Just try setting timerange to "all time" and run the search again

Re: no results found?

TISKAR — Fri, 06 Jan 2017 10:40:17 GMT

Thank you for your respense:

I checked, it's all temp, I loaded the data by creating another index, but when I restat the server, the event going from 11000 event to 0 event

Re: no results found?

TISKAR — Fri, 06 Jan 2017 10:58:10 GMT

Thank you for your respense:

I checked, it's all temp, I loaded the data by creating another index, but when I restat the server, the event going from 11000 event to 0 event

Re: no results found?

renjith_nair — Fri, 06 Jan 2017 11:02:30 GMT

Check the "frozenTimePeriodInSecs" property for the index on which this is imported. This defines the data retiring policy for the index (events older than frozenTimePeriodInSecs value in sec, will get deleted).
By default its value is 188697600 which is 6 years and your data may be older that that.