Deployment Architecture

Files in folders indexed but no results showing in search

bshamsian
Path Finder

I setup a directory to be scanned.  I went to Manager » Data inputs » Add data » Files & directories & clciked the new button and went thru the data preview and picked a file and made sure it looks ok with the given sourcetype that I created.  Once everything looked ok I changed the input from a single file to a folder - so the path to input file is something like this:

/opt/readonly/logs/event_recorder/2012-12-*

Once I created the new data input I see the folder in the input lists and I see that splunk has indexed over 300 files and the count goes up as new files come in.  However no results are returned in search for anything from these files.  I tried searching based on HOST field or source filed or sourcetype field and nothing comes back in search.

Index was set to default so they should have gone to main index. Tried using index=* but did not make any difference.

How can I find out what happened and what did splunk do with the data.

Splunk version 4.3

Tags (1)
0 Karma

sbrant_splunk
Splunk Employee
Splunk Employee

What timeframe are you searching across? It's possible that the time extraction or timezone is incorrect, so if you are doing a real-time search over the past 5 minutes, for instance, you will never see anything.

Perform your search over all time and see if any data comes back. If it does, you'll need to get the time extraction and timezone set correctly.

bshamsian
Path Finder

I thought about that and changed timeframe to all time but it not make a difference.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...