Deployment Architecture

way to identify data not indexed


hi all,
recently, following an update to Splunk 6.4.3 we are having trouble finding data with searches that worked before. We suspect it is related to re-indexing during the update. Is there a way to identify if there is data which still needs to be indexed?

0 Karma

Super Champion

this search will list out the hosts and their last time these host sent any data to splunk(sort lastTime).

| metadata type=hosts 
  | fields host firstTime lastTime totalCount
  | fieldformat firstTime=strftime(firstTime,"%x %X")
  | fieldformat lastTime=strftime(lastTime,"%x %X")
  | sort lastTime
>>> Happy Splunking !
0 Karma
Get Updates on the Splunk Community!

Running multiple macros in the same search

Hi all!I'm trying to run multiple macros in the same search and eventually aggregate the results from each ...

Logic of Compound Subsearch with inputlookup

I'm struggling to create a search using an inputlookup and multiple NOT searches.Background: I have an ...

Tagging Heavy Forwarders

This is a tip, not a question.&nbsp;<span class="lia-unicode-emoji" ...