topic What happened to the data? in Splunk Search

What happened to the data?

SumanPalisetty — Mon, 31 Oct 2022 07:49:38 GMT

Hi,

I have a question for my understanding. Kindly help.

You had data in the past, one fine day if you see there is no data, how do you troubleshoot?

Regards

Suman P.

Re: What happened to the data?

ITWhisperer — Mon, 31 Oct 2022 07:57:35 GMT

You are going to have to be more specific - is it that all of your data is "missing" or only prior to a particular point in time? Is it that some data is found by some searches but not by others? Can you narrow down the circumstances which lead to the missing data?

Re: What happened to the data?

SumanPalisetty — Mon, 31 Oct 2022 08:50:45 GMT

Hi,

Please give the answer in couple of lines for both the scenarios. For

1. Data from a certain date or certain sourcetype or index is missing

2. All the data is missing

Regards

Suman P.

Re: What happened to the data?

ITWhisperer — Mon, 31 Oct 2022 08:54:49 GMT

Check retention periods for your indexes if data past a certain date is missing

Try loosening the filters on your searches to see if the data appears

Check the status of the indexes (how much data do they have in them)

Re: What happened to the data?

FrankVl — Mon, 31 Oct 2022 14:02:06 GMT

This page in Splunk Docs is a good starting point:

https://docs.splunk.com/Documentation/Splunk/latest/Troubleshooting/Cantfinddata

In the end in boils down to understanding how exactly that data is supposed to come into splunk and then in a structured way troubleshoot which of the components in the chain that handles that data ingest is broken. The exact steps will differ depending on the ingest mechanism.