https://community.splunk.com/t5/Splunk-Search/Why-are-indexed-real-time-searches-not-returning-results/m-p/591620#M205950 <P>I have a Splunk Enterprise cluster (version 8.1.3) that for some reason, is not returning any results for indexed real-time searches, but regular searches and regular real-time searches work just fine.</P><P>When I have my search app configured with indexed_realtime_use_by_default = false, my real time searches return fine. When indexed_realtime_use_by_default is true, it returns no data for the same search.<BR /><BR />If I change the search from a real time search to any sort of historical search, I also get search results, including over the same time period my real time search is running.</P><P>Does anyone have any suggestions what I should look into?</P> Wed, 30 Mar 2022 20:13:46 GMT wishkres 2022-03-30T20:13:46Z https://community.splunk.com/t5/Splunk-Search/Why-are-indexed-real-time-searches-not-returning-results/m-p/591620#M205950 <P>I have a Splunk Enterprise cluster (version 8.1.3) that for some reason, is not returning any results for indexed real-time searches, but regular searches and regular real-time searches work just fine.</P><P>When I have my search app configured with indexed_realtime_use_by_default = false, my real time searches return fine. When indexed_realtime_use_by_default is true, it returns no data for the same search.<BR /><BR />If I change the search from a real time search to any sort of historical search, I also get search results, including over the same time period my real time search is running.</P><P>Does anyone have any suggestions what I should look into?</P> Wed, 30 Mar 2022 20:13:46 GMT https://community.splunk.com/t5/Splunk-Search/Why-are-indexed-real-time-searches-not-returning-results/m-p/591620#M205950 wishkres 2022-03-30T20:13:46Z https://community.splunk.com/t5/Splunk-Search/Why-are-indexed-real-time-searches-not-returning-results/m-p/591628#M205956 <P>Maybe there is a problem in your index time field extractions.&nbsp;</P> Wed, 30 Mar 2022 21:29:23 GMT https://community.splunk.com/t5/Splunk-Search/Why-are-indexed-real-time-searches-not-returning-results/m-p/591628#M205956 BahadirS 2022-03-30T21:29:23Z https://community.splunk.com/t5/Splunk-Search/Why-are-indexed-real-time-searches-not-returning-results/m-p/591810#M205992 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/242905">@BahadirS</a>&nbsp;Thanks! I've looked at the values of _time and _indextime on those events and it looks correct to me... Is there someplace else I should check?</P> Thu, 31 Mar 2022 15:30:16 GMT https://community.splunk.com/t5/Splunk-Search/Why-are-indexed-real-time-searches-not-returning-results/m-p/591810#M205992 wishkres 2022-03-31T15:30:16Z