Deployment Architecture

Files in folders indexed but no results showing in search

Path Finder

I setup a directory to be scanned.  I went to Manager » Data inputs » Add data » Files & directories & clciked the new button and went thru the data preview and picked a file and made sure it looks ok with the given sourcetype that I created.  Once everything looked ok I changed the input from a single file to a folder - so the path to input file is something like this:


Once I created the new data input I see the folder in the input lists and I see that splunk has indexed over 300 files and the count goes up as new files come in.  However no results are returned in search for anything from these files.  I tried searching based on HOST field or source filed or sourcetype field and nothing comes back in search.

Index was set to default so they should have gone to main index. Tried using index=* but did not make any difference.

How can I find out what happened and what did splunk do with the data.

Splunk version 4.3

Tags (1)
0 Karma

Splunk Employee
Splunk Employee

What timeframe are you searching across? It's possible that the time extraction or timezone is incorrect, so if you are doing a real-time search over the past 5 minutes, for instance, you will never see anything.

Perform your search over all time and see if any data comes back. If it does, you'll need to get the time extraction and timezone set correctly.

Path Finder

I thought about that and changed timeframe to all time but it not make a difference.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...