Archive
Highlighted

Data indexed but not displayed in Search in splunk enterprise

Engager

Hi Team,

I have successfully indexed the data but it is not getting displayed in Search, don't know what has gone wrong. Its a file-upload(one time indexing) type of data input configuration and i have created a new index for that particular file and a new sourcetype also.
I could able to see the logs while configuring the event breaking and timestamp format, but when i am searching for that particular index and sourcetype , i couldnt able to find any logs in the search head.
Kindly help me to identify the issue.

Its seems like a strange issue as iam experiencing it in even after two times reinstallation of splunk enterprise in my linux testing server.

Note: iam not experiencing this issue in any of the another linux server.

0 Karma
Highlighted

Re: Data indexed but not displayed in Search in splunk enterprise

SplunkTrust
SplunkTrust

Try expanding the time window to All Time. That will account for possible timestamp problems causing events to be indexed in the "future".

---
If this reply helps you, an upvote would be appreciated.
Highlighted

Re: Data indexed but not displayed in Search in splunk enterprise

Engager

i did searched for all time, but still couldnt able to find anything

0 Karma
Highlighted

Re: Data indexed but not displayed in Search in splunk enterprise

Contributor

searching "all time" is "everthing in the past till NOW".
You need to select the date in the future, like @d+10y

0 Karma
Highlighted

Re: Data indexed but not displayed in Search in splunk enterprise

Legend

@samsingnok52, would it be possible to give couple of mocked up rows from your file that you are trying to index. Please ensure to Anonymize/Mock any sensitive information. Also if possible the props.conf that you currently have.

Also have you checked index whether there are any events present. You can also use eventcount, tstats, dbinspect or metadata commands for this.




| eval message="Happy Splunking!!!"


Highlighted

Re: Data indexed but not displayed in Search in splunk enterprise

Engager

Hi Niket,

Thanks for your comments.I will try and revert back.
As of now , I have reinstalled the splunk enterprise and trying from the scratch.....

0 Karma
Highlighted

Re: Data indexed but not displayed in Search in splunk enterprise

SplunkTrust
SplunkTrust

I would be checking index _internal for messages showing how much data was indexed. If it doesn't show it, then it wasn't indexed. If it does show it, then you will be able to see WHERE it was indexed.

One possibility is that the user account you are using does not happen to have security access to that index.

0 Karma
Highlighted

Re: Data indexed but not displayed in Search in splunk enterprise

Path Finder

You could run a metadata search to see what time stamp is on the earliest and latest event.

| metadata type=sourcetype index=*

0 Karma