Data is missing

[chandana204]

Hi,

Recently I am seeing new issues in Splunk Enterprise. When i do searches in Splunk it's not pulling all data but my colleagues can see all data in their environment. Does anyone has any idea about this? I have same permissions as them. Please tell me what would be the reason?

Thanks,
Chandana

[PowerPacked · Accepted solution]

Possible Reasons
- different timezones
- Field Extractions, or some other knowledge Objects not shared with you.

[skoelpin]

Are you running on a different search head than they are? If not then most likely a permissions issue

[chandana204]

I am running same search head like them.

[PowerPacked]

Can you explain what do you mean by all data in the above question ?

[chandana204]

My colleagues can see full data from a particular index. When it comes to me, I can see some of the data from the same index not full data. I will give you an example.
index="cursor" timestamp=11/21/2017 02:20:03 to 11/21/2017 02:20:04
From the above query, actual events count is 24. when it comes to me I can see only 2 events. The splunk is not listing all 24 events.

[Sukisen1981]

Hi,

Based on your comments it does not seem to be an issue with splunk.
If everyone had not been able to see all data, then the issue would have been with splunk, but you are stating that your colleagues are able to see all data, whereas you are not. Does this seem like an issue with splunk?
Granted that you have the same permission as your colleagues,that does not mean you have access to all data.
With the very limited information that you have given, have you checked if you have permission to see data from ALL the indexes? You might have the same permissions , but unless you have permissions for ALL the indexes you will not be able to see all data points,

[chandana204]

I understand your point, I am running searches on particular indexes where I have proper permissions.