How to check if the indexer has indexed my data or not ?

[joydeep741]

I recently did a splunk confugiration. When I do a "splunk list monitor" on the forwarder , I see the logs are getting monitored.
But when query the serach head, I dont see them appearing.

How to check if the indexer has indexed my data or not ?

[woodcock]

To see (evidence of) events indexed in the last 5 minutes, do this:

| tstats max(_time) values(sourcetype) max(_indextime) WHERE (index=* OR index=_*) AND _index_earliest=-5m BY host

[nmclaughl1]

Thanks for jumping on this Woodcock! Tried it, _index_time (& index_time & _indextime) doesn't seem to be a field on my 6.6.3 SplunkCloud SH.

[woodcock]

I had 2 mistakes but I re-edited my original answer and this time I tested it! Try it now.

[gokadroid · Accepted solution]

If you have no reason to assume either your search is missing some keywords with which you are searching, or time duration is improper and really want to have a peek at data; go to the Splunk installation folder of the index and data should be present in "indexed" format:

$SPLUNK_HOME\var\lib\splunk\<indexName>\db\<bucketName>\rawdata\journal.gz

Basically for each index one should be able to find the data here in the "indexed" format:

$SPLUNK_HOME\var\lib\splunk\<indexName>\db\*

[nmclaughl1]

Is there a method for SplunkCloud indexing (i.e., no filesystem access) ?