All Apps and Add-ons

Can't see any data in the index while they seem to be there?

nicopelletier39
Explorer

Hello,

I'm using the MISP42app for which i receive a lot of events from custom command that query the MISP API.
All that events are retrieve from search query like this one `| mispgetioc field1=xxx field2=yyyy filed3=uuu`(command)

I've create a new index called misp where i would like to put the events that i retrieve from the search.
For this i pipe the previous command with  collect command like this | mispgetioc ... | collect index=misp.

When i go on index view i can see that my index is populated  with events, so it means it works (from what i understand): (URL:  http://localhost:9000/en-US/manager/misp42splunk/data/indexes#)Screenshot from 2023-03-26 11-55-20.png





But unfortunately when in the search URL:  http://localhost:9000/en-US/app/search/search i tap index=misp no events comes up:

Screenshot from 2023-03-26 12-03-49.png

Labels (1)
0 Karma
1 Solution

PickleRick
SplunkTrust
SplunkTrust

Your index list shows that your events are from three months ago. You search timerange (last 30 days) doesn't cover this.

View solution in original post

PickleRick
SplunkTrust
SplunkTrust

Your index list shows that your events are from three months ago. You search timerange (last 30 days) doesn't cover this.

nicopelletier39
Explorer

Thank you very much for your answer, 
indeed it was why i didn't see anything.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...