Data not showing up in search

[sourabhguha]

Hi,

I have an existing sourcetype for which I had some data earlier by pointing to a file. The events in the file show up in the search. Now I added another file and used the same sourcetype for it. However, the events from the new file do not show up in the search. i believe they are not getting indexed.

Please let me know what additional information or logs i can provide to help investigate this issue.

Thanks,

[ihuzaifazahoor]

Try to change preset value to All Time,Try to change your preset to All Time

[BobM · Accepted solution]

There are a few possibilities for this.

1) If a file is identical or at least the first 1k and last 1k are identical, splunk assumes it is the same file and does not re-index it.

2) If a file is random enough, splunk may think it is binary and not index it.

3) If a file is tabular but with different columns to a previous file, splunk indexes it but adds a number to the sourcetype to indicate it is a different type. e.g. IIS becomes IIS-2 etc.

4) If monitor overlaps another input it may not be indexed.

If you can identify one of these, we can work out a resolution.