Dashboards & Visualizations

After adding data as a text file into Splunk, why are no events shown under the Events tab when running a search?

Navanitha
Explorer

i have injected certain data into splunk (a text file). While doing a search, it gives me the total number of events matched, but does not show any events under Event tab. All other logs are working fine except this file.

Can someone pls help here

Tags (3)
0 Karma
1 Solution

chimell
Motivator

hi Navanitha
Change the timerange picker and re run the following search index=*

View solution in original post

chimell
Motivator

hi Navanitha
Change the timerange picker and re run the following search index=*

View solution in original post

Navanitha
Explorer

True..but in this case its not working.. 😞

0 Karma

chimell
Motivator

Hi Navanitha
you forgot to vote my answer

0 Karma

chimell
Motivator

Good .......

0 Karma

NOUMSSI
Builder

Hi Navanitha,
All time search should work right because this value of timerange will cover periodes includind periodes that your events have been produced.
So the best way is to use All time

0 Karma

Navanitha
Explorer

Hi Chimell,

It worked. Thanks. I can see the events now after changing the time range to 'previous year'.

But this is a random text file which I am using for some testing purpose. And it has data of last year. In this case All time search should work right?

0 Karma

gyslainlatsa
Motivator

hi,
you must perform you search in verbose mode.

0 Karma

gyslainlatsa
Motivator

you using what version of the splunk? and what mode of the search? fast mode, smart mode or verbose mode?

0 Karma

Navanitha
Explorer

6.2.2. I am doing this on a trial version.

0 Karma

gyslainlatsa
Motivator

see the specification below that propose

0 Karma

Navanitha
Explorer

I am searching it in verbose mode only..any other possibility pls..

0 Karma

gyslainlatsa
Motivator

try to do one query and go check the result

0 Karma

Navanitha
Explorer

yeah I could see some result for a query search..but still not able to see all the events. I need to extract the fields looking at the events. how do i get it?

0 Karma

gyslainlatsa
Motivator

enter * in the search bar at verbose mode

0 Karma

Navanitha
Explorer

no luck..when i type index=*, I am able to see all the events one with my source file also. But when i click on my source file, it again says 40events found. but says "no results found" under event tab.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!