Archive
Highlighted

Data not getting retrieved after indexing

Contributor

Hi,

I am importing the data through the inputs.conf file :

[default]
host = XXXXXXXXXX
[monitor://C:\Users\lg133108\Desktop\NEW_TEST]
disabled = false
crcSalt=<SOURCE>
index = upload_data_new
sourcetype = mysource_new

when I am going to search for my data :

index="uploaddatanew" , I am seeing 0 events ..please suggest me how to resolve this problem.

Please help !!

Thanks
Abhay

Tags (4)
0 Karma
Highlighted

Re: Data not getting retrieved after indexing

Splunk Employee
Splunk Employee

Check your time range? If you're indexing historical data, the time range might not include those events.

Does the index exist? Splunk won't create it for you, based on inputs.conf alone; you have to create the index first.

0 Karma
Highlighted

Re: Data not getting retrieved after indexing

Contributor

I have given the time range as "All time", yes ofcourse my data is historical data.

I created the index first then configured the inputs.conf and restarted the system..

Please help me in this regards,

Thanks,
Abhay

0 Karma
Highlighted

Re: Data not getting retrieved after indexing

Path Finder

I've noticed Splunk can be really picky when it comes to search.
This may be silly but what do you get if you try

host=xxxxxxxx index=upload_date_new sourcetype=mysource_new

on

All Time
0 Karma
Highlighted

Re: Data not getting retrieved after indexing

Path Finder

I've had issues with search and noticed that sometimes I won't get any results unless i type the whole shabang. I guess its pickiness is what makes it so intuitive once you get to a higher level :S

0 Karma