Getting Data In

Unable to search data unless all time is specified

priyanka_231019
Explorer

Hi 

 

I am unable to search my data unless I specify all time.

Tags (2)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @priyanka_231019,

when you say unable, it means that you don't have any result or you cannot run the search?

if the first, check the timestamp of your data, maybe there's an error in parsing and you have only future data.

Ciao.

Giuseppe

View solution in original post

priyanka_231019
Explorer

The issue is resolved. I had to update props.conf for TZ settings.

0 Karma

gcusello
SplunkTrust
SplunkTrust

hi @priyanka_231019,

Good!

Ciao and next time.

Giuseppe

P.S.: Karma Points are appreciated 😉

gcusello
SplunkTrust
SplunkTrust

Hi @priyanka_231019,

when you say unable, it means that you don't have any result or you cannot run the search?

if the first, check the timestamp of your data, maybe there's an error in parsing and you have only future data.

Ciao.

Giuseppe

Get Updates on the Splunk Community!

Developer Spotlight with Brett Adams

In our third Spotlight feature, we're excited to shine a light on Brett—a Splunk consultant, innovative ...

Index This | What can you do to make 55,555 equal 500?

April 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Say goodbye to manually analyzing phishing and malware threats with Splunk Attack ...

In today’s evolving threat landscape, we understand you’re constantly bombarded with phishing and malware ...