How to index lost data from a specific date range?

dantimola · ‎07-17-2017

Hi Splunkers,

I have AD server integrated to our splunk that is indexing Active Directory logs and we've lost data from specific date range, however, logs is active on that date. Is there any way to index that lost AD logs? The dates are July 13-15, 2017 to be specific.

Thanks,
Dan

sbbadri · ‎07-17-2017

Check below link,

https://answers.splunk.com/answers/72562/how-to-reindex-data-from-a-forwarder.html

How to index lost data from a specific date range?

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Persistent Queue at TcpOut — One of Splunk's Most Practical Features

Build resilience for the agentic era: Join us at Splunk Go San Jose

Manage Edge Processor pipelines end to end with APIs

Join the Conversation

How to index lost data from a specific date range?

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Persistent Queue at TcpOut — One of Splunk's Most Practical Features

Build resilience for the agentic era: Join us at Splunk Go San Jose

Manage Edge Processor pipelines end to end with APIs