Deployment Architecture

Indexing issues

bsrikanthreddy5
Path Finder

Hi, 

In Splunk's internal log file I can see the log file was processed by Splunk to index, but when I am trying to search the same index from SH, I am not able to find the events. This is happening intermittently on a few of the log files. 

Log from  splunkd HF: 
INFO TailReader - Batch input finished reading file='/xx/log/xxxxxxx/processed/archive/processed.log_2021-01-20T12:45:01.log'

No results from below search with all-time 
index=* source="/xxx/log/xxxxxxx/processed/archive/processed.log_2021-01-20T12:45:01.log"

Labels (2)
0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @bsrikanthreddy5,

Did you try searching with wider timerange? Or "All Time". There maybe timestamp problem?

 

If this reply helps you an upvote is appreciated.
0 Karma

bsrikanthreddy5
Path Finder

yes, I have used an all-time in time picker. 

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...