Data not getting retrieved after indexing

[abhayneilam]

Hi,

I am importing the data through the inputs.conf file :

[default]
host = XXXXXXXXXX
[monitor://C:\Users\lg133108\Desktop\NEW_TEST]
disabled = false
crcSalt=<SOURCE>
index = upload_data_new
sourcetype = mysource_new

when I am going to search for my data :

index="upload_data_new" , I am seeing 0 events ..please suggest me how to resolve this problem.

Please help !!

Thanks
Abhay

[SplunkUser5888]

I've noticed Splunk can be really picky when it comes to search.
This may be silly but what do you get if you try

host=xxxxxxxx index=upload_date_new sourcetype=mysource_new

on

All Time

[SplunkUser5888]

I've had issues with search and noticed that sometimes I won't get any results unless i type the whole shabang. I guess its pickiness is what makes it so intuitive once you get to a higher level :S

[sowings]

Check your time range? If you're indexing historical data, the time range might not include those events.

Does the index exist? Splunk won't create it for you, based on inputs.conf alone; you have to create the index first.

[abhayneilam]

I have given the time range as "All time", yes ofcourse my data is historical data.

I created the index first then configured the inputs.conf and restarted the system..

Please help me in this regards,

Thanks,
Abhay