Splunk Search

no results found?

TISKAR
Builder

Hey Splunkers:

I indexed my data, and I worked quietly, but today I ran the same query, output is : "no results found"

source="lightsaber_bis2.csv" host="PC" index="index3" sourcetype="csv"

Splunk: Splunk Entreprise.

Can you Help please.

Tags (1)
0 Karma
1 Solution

renjith_nair
SplunkTrust
SplunkTrust

Try changing the time range in Splunk search bar.
It's possible that you indexed the data with old timestamps and searching for latest.

Just try setting timerange to "all time" and run the search again

Happy Splunking!

View solution in original post

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

Try changing the time range in Splunk search bar.
It's possible that you indexed the data with old timestamps and searching for latest.

Just try setting timerange to "all time" and run the search again

Happy Splunking!
0 Karma

TISKAR
Builder

Thank you for your respense:

I checked, it's all temp, I loaded the data by creating another index, but when I restat the server, the event going from 11000 event to 0 event

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

Check the "frozenTimePeriodInSecs" property for the index on which this is imported. This defines the data retiring policy for the index (events older than frozenTimePeriodInSecs value in sec, will get deleted).
By default its value is 188697600 which is 6 years and your data may be older that that.

Happy Splunking!
0 Karma

TISKAR
Builder

Thank you for your respense:

I checked, it's all temp, I loaded the data by creating another index, but when I restat the server, the event going from 11000 event to 0 event

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...