After adding data as a text file into Splunk, why are no events shown under the Events tab when running a search?

[Navanitha]

i have injected certain data into splunk (a text file). While doing a search, it gives me the total number of events matched, but does not show any events under Event tab. All other logs are working fine except this file.

Can someone pls help here

[chimell · Accepted solution]

hi Navanitha
Change the timerange picker and re run the following search index=*

[Navanitha]

True..but in this case its not working.. 😞

[chimell]

Hi Navanitha
you forgot to vote my answer

[chimell]

Good .......

[NOUMSSI]

Hi Navanitha,
All time search should work right because this value of timerange will cover periodes includind periodes that your events have been produced.
So the best way is to use All time

[Navanitha]

Hi Chimell,

It worked. Thanks. I can see the events now after changing the time range to 'previous year'.

But this is a random text file which I am using for some testing purpose. And it has data of last year. In this case All time search should work right?

[gyslainlatsa]

hi,
you must perform you search in verbose mode.

[gyslainlatsa]

you using what version of the splunk? and what mode of the search? fast mode, smart mode or verbose mode?

[Navanitha]

6.2.2. I am doing this on a trial version.

[gyslainlatsa]

see the specification below that propose

[Navanitha]

I am searching it in verbose mode only..any other possibility pls..

[gyslainlatsa]

try to do one query and go check the result

[Navanitha]

yeah I could see some result for a query search..but still not able to see all the events. I need to extract the fields looking at the events. how do i get it?

[gyslainlatsa]

enter * in the search bar at verbose mode

[Navanitha]

no luck..when i type index=*, I am able to see all the events one with my source file also. But when i click on my source file, it again says 40events found. but says "no results found" under event tab.