Running Splunk 5.0.1 on windows 2008R2. I had to move my index to another server...followed the steps perfectly...rolled hot to warm....copied $SPLUNK_home...\defaltdb to same location on new server...started splunk. All looks good but for example on the summary page HostA has 6500 events and when I search all time for HOSTA I on receive 10 events (from today)?? Why can't I access the events copied over? It's not a permissions issue?? Another thing I on a workgroup enviornment not an active directory domain. The user that I am logged in on is the same username on each system.