Getting Data In

An index was not prepared to ingest data, so I cannot see events from previous days. How do I fix this?

TheJagoff
Communicator

Hello,

I forgot to have an index ready when I started to ingest data (log file with data from last week to present) from a Universal Forwarder to my indexer. I saw the message warning me of this, so I created the index and the only data that is appearing in the new index and verified via searching is the data from today. The data is timestamped with date/time after I created the index and it is producing the interesting fields and line breaking correctly with good timestamps.

The data from the previous days isn't coming through.

So the question is; How can I fix this for this index only?

Many thanks.

1 Solution

skoelpin
SplunkTrust
SplunkTrust

It will automatically go to your main index. So go look in index=main and sort by the source to see your files.

How much data did you have in your main index before this data came in?

If a lot then you have a problem.. A few option here

1) Temporarily taylor your searches to account for both indexes and narrow down on your source
2) If the data is still on your logfiles, you could easily reindex them by clearing the fishbucket
3) Deal with losing a few days worth of data
4) Manually moving the data from your main index into your new index

Option 4 is tricky and will require some Splunk knowledge. I just posted a solution to how to do this exact thing the other day

https://answers.splunk.com/answers/474795/whats-the-best-way-to-migrate-db-from-one-drive-to.html

View solution in original post

skoelpin
SplunkTrust
SplunkTrust

It will automatically go to your main index. So go look in index=main and sort by the source to see your files.

How much data did you have in your main index before this data came in?

If a lot then you have a problem.. A few option here

1) Temporarily taylor your searches to account for both indexes and narrow down on your source
2) If the data is still on your logfiles, you could easily reindex them by clearing the fishbucket
3) Deal with losing a few days worth of data
4) Manually moving the data from your main index into your new index

Option 4 is tricky and will require some Splunk knowledge. I just posted a solution to how to do this exact thing the other day

https://answers.splunk.com/answers/474795/whats-the-best-way-to-migrate-db-from-one-drive-to.html

TheJagoff
Communicator

Yep, it's there in main. We will tailor our searches accordingly. Thank you!

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...