Developing for Splunk Enterprise
Highlighted

can't see all the event of an index anymore

Path Finder

If I search | eventcount summarize=false index=index3 the answer is count : 32339388
If I search index=index3 182154 event events are count with empty days 42 days before the last days.

I've made 2 changes before to have this behavior :

  • upgrade to 7.1
  • go from a free license to a dev licence on my lab machine.

of course i'm on "all-time" period (or hope to be, because it's look like I'm not)

thank's for your help 🙂

Tags (2)
0 Karma
Highlighted

Re: can't see all the event of an index anymore

Champion

Did you run both the query for all time?

0 Karma
Highlighted

Re: can't see all the event of an index anymore

Path Finder

Thank's. Yes. I did it with the web interface. Is there a SPL command to include all time period ?

0 Karma
Highlighted

Re: can't see all the event of an index anymore

SplunkTrust
SplunkTrust
0 Karma
Highlighted

Re: can't see all the event of an index anymore

Path Finder

OK I've found the limit : "Search auto-finalized after disk usage limit (0MB) reached. "

View solution in original post

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.