Getting Data In

Data not getting retrieved after indexing

abhayneilam
Contributor

Hi,

I am importing the data through the inputs.conf file :

[default]
host = XXXXXXXXXX
[monitor://C:\Users\lg133108\Desktop\NEW_TEST]
disabled = false
crcSalt=<SOURCE>
index = upload_data_new
sourcetype = mysource_new

when I am going to search for my data :

index="upload_data_new" , I am seeing 0 events ..please suggest me how to resolve this problem.

Please help !!

Thanks
Abhay

Tags (4)
0 Karma

SplunkUser5888
Path Finder

I've noticed Splunk can be really picky when it comes to search.
This may be silly but what do you get if you try

host=xxxxxxxx index=upload_date_new sourcetype=mysource_new

on

All Time
0 Karma

SplunkUser5888
Path Finder

I've had issues with search and noticed that sometimes I won't get any results unless i type the whole shabang. I guess its pickiness is what makes it so intuitive once you get to a higher level :S

0 Karma

sowings
Splunk Employee
Splunk Employee

Check your time range? If you're indexing historical data, the time range might not include those events.

Does the index exist? Splunk won't create it for you, based on inputs.conf alone; you have to create the index first.

0 Karma

abhayneilam
Contributor

I have given the time range as "All time", yes ofcourse my data is historical data.

I created the index first then configured the inputs.conf and restarted the system..

Please help me in this regards,

Thanks,
Abhay

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>