Getting Data In

Splunk Fundamentals 1 - Lab 4 - Datas not found after indexation

Darkpat60
New Member

Hello,

I follow the Splunk Fundamentals 1 and have installed Splunk 8.2.1 as a local instance (Windows 10). The lab 4 material is composed of 3 files that have to be uploaded on splunk in an admin session. I follow the instructions and that seems to be working ok, but I don't see the indexed datas neither on the admin or power session after.

I tried to change the time span of the search results, to search in my datasets (empty in both sessions), nothing appears. I reuploaded the material and while saving a cvs file it seems the file was already there (from the first upload). But again, no results and no datas appear to have been indexed/ingested into splunk after.

Has anyone any idea to fix that or ever encountered this problem? Thanks a lot folks!

Labels (1)
0 Karma

Darkpat60
New Member

Ok sorry to spam, I kind of found the datas, they appear by clicking the "create a table view" and selecting the right index.But It seems that the datas is kind of processed this way, anyway the indexations was working.

So I made a search with an sample IP from the logs and had results with the searchbar. So ok datas are there (even if I don't have a view of the sources and other stats on the logs). Anyway, hope it helps, as the version seems to have changed since the version of fundamentals 1 materials.

0 Karma
Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...