All indexed data from earlier than yesterday disappeared.

[Cuyose]

I was hoping someone could help me here. We had been ingesting data to an index just fine for weeks, Then all of the sudden all data from yesterday and earlier is missing. index is currently working fine since that point in time.

What should I be checking?

[jdonn_splunk]

There is no reason that this would ever happen without some sort of outside influence. Some places that I would look:

• Were changes made to your storage?
• Verify that indexes.conf is configured properly... http://docs.splunk.com/Documentation/Splunk/6.4.3/Admin/Indexesconf
• Search "index=* startdaysago=7"

Good luck!