Getting Data In

How to check if the indexer has indexed my data or not ?

joydeep741
Path Finder

I recently did a splunk confugiration. When I do a "splunk list monitor" on the forwarder , I see the logs are getting monitored.
But when query the serach head, I dont see them appearing.

How to check if the indexer has indexed my data or not ?

0 Karma
1 Solution

gokadroid
Motivator

If you have no reason to assume either your search is missing some keywords with which you are searching, or time duration is improper and really want to have a peek at data; go to the Splunk installation folder of the index and data should be present in "indexed" format:

$SPLUNK_HOME\var\lib\splunk\<indexName>\db\<bucketName>\rawdata\journal.gz

Basically for each index one should be able to find the data here in the "indexed" format:

$SPLUNK_HOME\var\lib\splunk\<indexName>\db\*

View solution in original post

0 Karma

woodcock
Esteemed Legend

To see (evidence of) events indexed in the last 5 minutes, do this:

| tstats max(_time) values(sourcetype) max(_indextime) WHERE (index=* OR index=_*) AND _index_earliest=-5m BY host

nmclaughl1
Explorer

Thanks for jumping on this Woodcock! Tried it, _index_time (& index_time & _indextime) doesn't seem to be a field on my 6.6.3 SplunkCloud SH.

0 Karma

woodcock
Esteemed Legend

I had 2 mistakes but I re-edited my original answer and this time I tested it! Try it now.

0 Karma

gokadroid
Motivator

If you have no reason to assume either your search is missing some keywords with which you are searching, or time duration is improper and really want to have a peek at data; go to the Splunk installation folder of the index and data should be present in "indexed" format:

$SPLUNK_HOME\var\lib\splunk\<indexName>\db\<bucketName>\rawdata\journal.gz

Basically for each index one should be able to find the data here in the "indexed" format:

$SPLUNK_HOME\var\lib\splunk\<indexName>\db\*
0 Karma

nmclaughl1
Explorer

Is there a method for SplunkCloud indexing (i.e., no filesystem access) ?

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk Observability Cloud – June 2025

What’s New in Splunk Observability Cloud – June 2025 We are excited to announce the latest enhancements to ...

Almost Too Eventful Assurance: Part 2

Work While You SleepBefore you can rely on any autonomous remediation measures, you need to close the loop ...

Leveraging Detections from the Splunk Threat Research Team & Cisco Talos

 Stay ahead of today’s evolving threats with the combined power of the Splunk Threat Research Team (STRT) and ...