Getting Data In

data missing in the index after session log out

DataOrg
Builder

I have added data through "ADD Data" after completing and i could able to search data.
But data getting missed or search not able to fetch data once splunk session time out.
1. Bucket space is available (i am able to see last week indexed data and problem occurring for last two days)
2. disk space is available
3. i am not able to see indexed data in the bucket /db path.
4. i could able to see last week indexed data ,which is also added thro "ADD data" and issue happening last two days"

please let me know how to troubleshoot issue further?

0 Karma

nickhills
Ultra Champion

Can you be specific about how you used "ADD Data"?
What is the source of the data (ie what system is generating it) and did you upload a file, or add a monitor?

If my comment helps, please give it a thumbs up!
0 Karma

DataOrg
Builder

@nickhillscpl its a upload data.
log file is generated by windows machine and events are based on timestamp

0 Karma

nickhills
Ultra Champion

When you upload a file it is not continuously monitored, only what was in the file when you uploaded it will ever be indexed.

I am not sure from your question if this is exactly what you are describing.

If you want Splunk to continuously monitor a file and index any changes, you need to add a "monitor" for it, probably with a Universal forwarder.

If my comment helps, please give it a thumbs up!
0 Karma
Get Updates on the Splunk Community!

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Enhance Security Operations with Automated Threat Analysis in the Splunk EcosystemAre you leveraging ...

Splunk Developers: Go Beyond the Dashboard with These .Conf25 Sessions

  Whether you’re building custom apps, diving into SPL2, or integrating AI and machine learning into your ...

Index This | How do you write 23 only using the number 2?

July 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...