Archive
Highlighted

no results found?

Builder

Hey Splunkers:

I indexed my data, and I worked quietly, but today I ran the same query, output is : "no results found"

source="lightsaber_bis2.csv" host="PC" index="index3" sourcetype="csv"

Splunk: Splunk Entreprise.

Can you Help please.

Tags (1)
0 Karma
Highlighted

Re: no results found?

SplunkTrust
SplunkTrust

Try changing the time range in Splunk search bar.
It's possible that you indexed the data with old timestamps and searching for latest.

Just try setting timerange to "all time" and run the search again

View solution in original post

0 Karma
Highlighted

Re: no results found?

Builder

Thank you for your respense:

I checked, it's all temp, I loaded the data by creating another index, but when I restat the server, the event going from 11000 event to 0 event

0 Karma
Highlighted

Re: no results found?

Builder

Thank you for your respense:

I checked, it's all temp, I loaded the data by creating another index, but when I restat the server, the event going from 11000 event to 0 event

0 Karma
Highlighted

Re: no results found?

SplunkTrust
SplunkTrust

Check the "frozenTimePeriodInSecs" property for the index on which this is imported. This defines the data retiring policy for the index (events older than frozenTimePeriodInSecs value in sec, will get deleted).
By default its value is 188697600 which is 6 years and your data may be older that that.

0 Karma