indexing Data issue

[Mark_Holm]

Hi all,

I am totally new to SPLUNK. I am going thru the free online class Splunk Fundamentals. I have uploaded the example data into SPLUNK exactly as directed by the directions. However, when I log out then log back in from Admin to a Power user to search, the data is in SPLUNK but it says it is not indexed. Isn't the data automatically indexed upon uploading the files? The instructions do not say specifically, but after uploading the data, it expects you to see 239,625 Events Indexed. Yet for what ever reason, it is not indexding the data, what could cause that issue? I've redon the uploads 7 times now. I even went thru wiped out everything (am working on a VM) re-down loaded SPLUNK and started from scratch, and still no indexing. What the heck am I missing?

TIA

[richgalloway]

Have you tried searching for the data as Admin, without signing off?  It should be searchable within seconds after it is uploaded.  Check your time range to ensure your search covers the times when the data was generated.  If data doesn't show up, select "All Time".  Make sure your search query includes the right index name.  Do not rely on default indexes in your queries.

When you say "it says it is not indexed", what is the "it" that is saying that?  What is the exact question that was asked to get that response?