Getting Data In

I can't see data I know is indexed

cfrln
Explorer

I have data indexed but the "all indexed data" dashboard module is empty. Searching for * over all time produces no results.

Tags (1)
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

If you're certain the data is indexed, then it is likely that your default indexes do not include the index in which is it is stored. If you do have permission to view it, you can try:

index=*

You can see what indexes are available to you by running the search:

| eventcount summarize=false index=* index=_*

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

If you're certain the data is indexed, then it is likely that your default indexes do not include the index in which is it is stored. If you do have permission to view it, you can try:

index=*

You can see what indexes are available to you by running the search:

| eventcount summarize=false index=* index=_*

cfrln
Explorer

One reason this can happen is if your data is in an index that is not in your list of default indexes.

By default, the user, admin and power roles that ship with the product have only the main index in the list of default indexes to search. Unless you explicitly specify the index in your search you will not see data in other indexes.

To see if this is the case, go to Manager -> Indexes to see what indexes exist and the # of events and time range for data in each index, and go to Manager -> Access Controls -> Roles to see what default indexes are set for your role. To fix it, add the index you need to your role's list of default indexes here.

Get Updates on the Splunk Community!

Index This | Why do they call it hyper text?

November 2023 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

State of Splunk Careers 2023: Career Resilience and the Continued Value of Splunk

For the past three years, Splunk has partnered with Enterprise Strategy Group to conduct a survey that gauges ...

The Great Resilience Quest: 9th Leaderboard Update

The ninth leaderboard update (11.9-11.22) for The Great Resilience Quest is out >> Kudos to all the ...