Why does my sample data not show up in search after using the "Add Data" function?

[dbcase]

Hi,

I have the below data that I'm trying to import into Splunk. Right now I'm working with a sample file only 10 entries long. Below is a snippet. I'm using the "Add Data" function and using the default source type and putting the data into a brand new index and when I go to search, there are 0 results. Thoughts?

"Premise"="1000190" "Type"="doorLock" "SensorId"="000d6f0000e95c62.1 " "Label"="Door Lock" "Manufacturer"="Yale" "Model"="YRD220/240 TSDB" "Firmware version"="0x00840850" "Hardware version"="17" "UserProperty.NearEndRssi"="-50" "UserProperty.pim.batteryLow"="false" "UserProperty.NearEndLqi"="255" "UserProperty.label"="Door Lock" "UserProperty.deadboltJammed"="false" "Battery Operated"="True" "Voltage"="N/A" "FE radio"="NA/NA" "NE radio"="-50/255" "Date added"="Thu Aug 25 17:24:39 CDT 2016" "Date of last communication"="Tue May 16 11:06:51 CDT 2017" "In Communication Failure"="false" "In firmware upgrade failure"="false" "Firmware upgrade available"="false" "Is Locked"="true" "Max Users"="250" Operation Mode="normal"
"Premise"="1000190" "Type"="sensor" "SensorId"="000d6f000babf653.1 " "Label"="Ecolink Door" "Manufacturer"="Ecolink" "Model"="4655BC0-R" "Firmware version"="0x20160921" "Hardware version"="1" "UserProperty.Zone.ZoneType"="1" "UserProperty.NearEndRssi"="-34" "UserProperty.NearEndLqi"="255" "UserProperty.IASZoneStatus"="32" "UserProperty.Zone.ZoneNumber"="27" "UserProperty.orderIndex"="8" "UserProperty.Zone.SwingerShutdown"="false" "UserProperty.Zone.TestMode"="false" "UserProperty.Zone.Edited"="true" "UserProperty.label"="Ecolink Door" "UserProperty.Zone.FunctionType"="7" "UserProperty.Zone.Bypassed"="false" "UserProperty.Zone.SensorId"="25" "Battery Operated"="True" "Voltage"="2.9V" "FE radio"="-27/255" "NE radio"="-34/255" "Date added"="Mon Mar 20 20:37:02 CDT 2017" "Date of last communication"="Tue May 16 11:04:51 CDT 2017" "In Communication Failure"="false" "In firmware upgrade failure"="false" "Firmware upgrade available"="false" "Sensor Status"="SensorStatus [faulted=false; tampered=false; lowBattery=false; trouble=false; ACMainsFault=false]" "Sensor Type"="SensorTypeContactSwitch" "Is Sensor Type Configurable"="false" "Is Security Sensor"="true" Temperature="25.0C"
"Premise"="1000190" "Type"="sensor" "SensorId"="000d6f000b5c9db5.1 " "Label"="New Motion" "Manufacturer"="Universal Electronics Inc" "Model"="URC4470BC0-X-R" "Firmware version"="0x040f0544" "Hardware version"="5" "UserProperty.Zone.ZoneType"="3" "UserProperty.NearEndRssi"="-33" "UserProperty.NearEndLqi"="255" "UserProperty.IASZoneStatus"="32" "UserProperty.Zone.ZoneNumber"="25" "UserProperty.orderIndex"="6" "UserProperty.Zone.SwingerShutdown"="false" "UserProperty.Zone.TestMode"="false" "UserProperty.Zone.Edited"="true" "UserProperty.label"="New Motion" "UserProperty.Zone.FunctionType"="10" "UserProperty.Zone.Bypassed"="false" "UserProperty.Zone.SensorId"="23" "Battery Operated"="True" "Voltage"="2.9V" "FE radio"="-27/255" "NE radio"="-33/255" "Date added"="Sat Mar 11 17:33:22 CST 2017" "Date of last communication"="Tue May 16 10:52:53 CDT 2017" "In Communication Failure"="false" "In firmware upgrade failure"="false" "Firmware upgrade available"="false" "Sensor Status"="SensorStatus [faulted=false; tampered=false; lowBattery=false; trouble=false; ACMainsFault=false]" "Sensor Type"="SensorTypeMotion" "Is Sensor Type Configurable"="false" "Is Security Sensor"="true" Temperature="24.98C"
"Premise"="1000190" "Type"="sensor" "SensorId"="001e5e09021a3e84.1 " "Label"="Button" "Manufacturer"="SALUS" "Model"="SS883ZB" "Firmware version"="0x20160721" "Hardware version"="1" "UserProperty.Zone.ZoneType"="1" "UserProperty.NearEndRssi"="-35" "UserProperty.NearEndLqi"="255" "UserProperty.IASZoneStatus"="32" "UserProperty.Zone.ZoneNumber"="19" "UserProperty.orderIndex"="2" "UserProperty.Zone.SwingerShutdown"="false" "UserProperty.Zone.TestMode"="false" "UserProperty.Zone.Edited"="true" "UserProperty.label"="Button" "UserProperty.Zone.FunctionType"="5" "UserProperty.Zone.Bypassed"="false" "UserProperty.Zone.SensorId"="17" "Battery Operated"="True" "Voltage"="3.1V" "FE radio"="-27/255" "NE radio"="-35/255" "Date added"="Mon Sep 26 19:28:12 CDT 2016" "Date of last communication"="Tue May 16 11:00:48 CDT 2017" "In Communication Failure"="false" "In firmware upgrade failure"="false" "Firmware upgrade available"="false" "Sensor Status"="SensorStatus [faulted=false; tampered=false; lowBattery=false; trouble=false; ACMainsFault=false]" "Sensor Type"="SensorTypeContactSwitch" "Is Sensor Type Configurable"="false" "Is Security Sensor"="true" Temperature="25.5C"

[DalJeanis]

try index=* "0x00840850" and see if anything comes up. That would indicate if the events got rerouted somewhere else, and would show you where.

[dbcase]

Hi Dal Jeanis,

Thats a great idea! It "worked" by showing me that the data is simply not there even though Splunk indicates that it was imported. Something is amiss somewhere but I dunno where.

[DalJeanis]

@dbcase - did you ever find your missing events?

[rphillips_splk]

@dbcase some things to check:

1.) does the index exist at the indexer or instance you've ingested the sample data to? If not, create it in indexes.conf

2.) does your search include the index name in the search query (ie: index=new_index ....) ? If not, include that in your search as the new index is likely not in the list of indexes searched by default (if you do not include the index name in your search query)

3.) does the role your user belong to have access to search this index? Check via >Settings>Access controls » Roles »

Indexes
Indexes searched by default

4.) do you see results if you search just that index ? Perhaps the source value needs to be adjusted (ie: source=*sourcelog.log*) to match your source file

[dbcase]

It is a Splunk Cloud instance.

The search string is pretty simple (see below). I've tried it with and without the source type and quotes, no luck

index="dancalderwood" sourcetype=dan2

[dbcase]

Hi Phillips,

On #1. Yes sir, double checked

2. yes, and the date range is all time

3. yes, I'm admin

4. I searched with and without a source type same results

[rphillips_splk]

is this a standalone instance or distributed deployment? Can you paste the search you are using