Getting Data In

How to check if the indexer has indexed my data or not ?

joydeep741
Path Finder

I recently did a splunk confugiration. When I do a "splunk list monitor" on the forwarder , I see the logs are getting monitored.
But when query the serach head, I dont see them appearing.

How to check if the indexer has indexed my data or not ?

0 Karma
1 Solution

gokadroid
Motivator

If you have no reason to assume either your search is missing some keywords with which you are searching, or time duration is improper and really want to have a peek at data; go to the Splunk installation folder of the index and data should be present in "indexed" format:

$SPLUNK_HOME\var\lib\splunk\<indexName>\db\<bucketName>\rawdata\journal.gz

Basically for each index one should be able to find the data here in the "indexed" format:

$SPLUNK_HOME\var\lib\splunk\<indexName>\db\*

View solution in original post

0 Karma

woodcock
Esteemed Legend

To see (evidence of) events indexed in the last 5 minutes, do this:

| tstats max(_time) values(sourcetype) max(_indextime) WHERE (index=* OR index=_*) AND _index_earliest=-5m BY host

nmclaughl1
Explorer

Thanks for jumping on this Woodcock! Tried it, _index_time (& index_time & _indextime) doesn't seem to be a field on my 6.6.3 SplunkCloud SH.

0 Karma

woodcock
Esteemed Legend

I had 2 mistakes but I re-edited my original answer and this time I tested it! Try it now.

0 Karma

gokadroid
Motivator

If you have no reason to assume either your search is missing some keywords with which you are searching, or time duration is improper and really want to have a peek at data; go to the Splunk installation folder of the index and data should be present in "indexed" format:

$SPLUNK_HOME\var\lib\splunk\<indexName>\db\<bucketName>\rawdata\journal.gz

Basically for each index one should be able to find the data here in the "indexed" format:

$SPLUNK_HOME\var\lib\splunk\<indexName>\db\*
0 Karma

nmclaughl1
Explorer

Is there a method for SplunkCloud indexing (i.e., no filesystem access) ?

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...