Files in folders indexed but no results showing in search

[bshamsian]

I setup a directory to be scanned.  I went to Manager » Data inputs » Add data » Files & directories & clciked the new button and went thru the data preview and picked a file and made sure it looks ok with the given sourcetype that I created.  Once everything looked ok I changed the input from a single file to a folder - so the path to input file is something like this:

/opt/readonly/logs/event_recorder/2012-12-*

Once I created the new data input I see the folder in the input lists and I see that splunk has indexed over 300 files and the count goes up as new files come in.  However no results are returned in search for anything from these files.  I tried searching based on HOST field or source filed or sourcetype field and nothing comes back in search.

Index was set to default so they should have gone to main index. Tried using index=* but did not make any difference.

How can I find out what happened and what did splunk do with the data.

Splunk version 4.3

[sbrant_splunk]

What timeframe are you searching across? It's possible that the time extraction or timezone is incorrect, so if you are doing a real-time search over the past 5 minutes, for instance, you will never see anything.

Perform your search over all time and see if any data comes back. If it does, you'll need to get the time extraction and timezone set correctly.

[bshamsian]

I thought about that and changed timeframe to all time but it not make a difference.