Recently I am seeing new issues in Splunk Enterprise. When i do searches in Splunk it's not pulling all data but my colleagues can see all data in their environment. Does anyone has any idea about this? I have same permissions as them. Please tell me what would be the reason?
My colleagues can see full data from a particular index. When it comes to me, I can see some of the data from the same index not full data. I will give you an example.
index="cursor" timestamp=11/21/2017 02:20:03 to 11/21/2017 02:20:04
From the above query, actual events count is 24. when it comes to me I can see only 2 events. The splunk is not listing all 24 events.
Based on your comments it does not seem to be an issue with splunk.
If everyone had not been able to see all data, then the issue would have been with splunk, but you are stating that your colleagues are able to see all data, whereas you are not. Does this seem like an issue with splunk?
Granted that you have the same permission as your colleagues,that does not mean you have access to all data.
With the very limited information that you have given, have you checked if you have permission to see data from ALL the indexes? You might have the same permissions , but unless you have permissions for ALL the indexes you will not be able to see all data points,