hi Navanitha
Change the timerange picker and re run the following search index=*
hi Navanitha
Change the timerange picker and re run the following search index=*
True..but in this case its not working.. 😞
Hi Navanitha
you forgot to vote my answer
Good .......
Hi Navanitha,
All time search should work right because this value of timerange will cover periodes includind periodes that your events have been produced.
So the best way is to use All time
Hi Chimell,
It worked. Thanks. I can see the events now after changing the time range to 'previous year'.
But this is a random text file which I am using for some testing purpose. And it has data of last year. In this case All time search should work right?
hi,
you must perform you search in verbose mode.
you using what version of the splunk? and what mode of the search? fast mode, smart mode or verbose mode?
6.2.2. I am doing this on a trial version.
see the specification below that propose
I am searching it in verbose mode only..any other possibility pls..
try to do one query and go check the result
yeah I could see some result for a query search..but still not able to see all the events. I need to extract the fields looking at the events. how do i get it?
enter *
in the search bar at verbose mode
no luck..when i type index=*, I am able to see all the events one with my source file also. But when i click on my source file, it again says 40events found. but says "no results found" under event tab.