Getting Data In

How to check if the indexer has indexed my data or not ?

Path Finder

I recently did a splunk confugiration. When I do a "splunk list monitor" on the forwarder , I see the logs are getting monitored.
But when query the serach head, I dont see them appearing.

How to check if the indexer has indexed my data or not ?

0 Karma
1 Solution

Motivator

If you have no reason to assume either your search is missing some keywords with which you are searching, or time duration is improper and really want to have a peek at data; go to the Splunk installation folder of the index and data should be present in "indexed" format:

$SPLUNK_HOME\var\lib\splunk\<indexName>\db\<bucketName>\rawdata\journal.gz

Basically for each index one should be able to find the data here in the "indexed" format:

$SPLUNK_HOME\var\lib\splunk\<indexName>\db\*

View solution in original post

0 Karma

Esteemed Legend

To see (evidence of) events indexed in the last 5 minutes, do this:

| tstats max(_time) values(sourcetype) max(_indextime) WHERE (index=* OR index=_*) AND _index_earliest=-5m BY host

Explorer

Thanks for jumping on this Woodcock! Tried it, _index_time (& index_time & _indextime) doesn't seem to be a field on my 6.6.3 SplunkCloud SH.

0 Karma

Esteemed Legend

I had 2 mistakes but I re-edited my original answer and this time I tested it! Try it now.

0 Karma

Motivator

If you have no reason to assume either your search is missing some keywords with which you are searching, or time duration is improper and really want to have a peek at data; go to the Splunk installation folder of the index and data should be present in "indexed" format:

$SPLUNK_HOME\var\lib\splunk\<indexName>\db\<bucketName>\rawdata\journal.gz

Basically for each index one should be able to find the data here in the "indexed" format:

$SPLUNK_HOME\var\lib\splunk\<indexName>\db\*

View solution in original post

0 Karma

Explorer

Is there a method for SplunkCloud indexing (i.e., no filesystem access) ?

0 Karma