splunk data ingestion issue

[harman]

i am uploading the data in the text format and that data contains logs but when i successfully upload the data of particular month some of the days of the data is missing or not searcheable when i check the data of perday it shows events of all the days but when i click on some of the days i got no results can you please tell me that what is my issue and where i am wrong so that i will create the proper and accurate dashboards 

[livehybrid · Accepted solution]

Hi @harman 

Its hard to see without seeing the data, but it sounds to me like you might be suffering from date/time extraction issues. For example 03/02/2026 could end up as 2nd March OR 3rd Feb depending on if the date is extracted properly.

Are you adding the data through the Add Data section in the UI? Can you see the dates displayed in the preview window when doing this? Are you using a predefined sourcetype or have you made a custom sourcetype?

You may need to look at setting TIME_PREFIX and TIME_FORMAT for your data.

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[harman]

I am uploading the june 2025, may 2025, and april 2025 data individually and i saw in every month the data for 9 to 10 days is missing  and when i apply the time filter like previous year then the events spread to all the months i have total 19,00,000 events per month approx but only 12,00,000 events are assigned to the june month other 7,00,000 events are assigned to the other months why i am stucked in this condition from 2 weeks  maybe it is the timestamp and date issue but i dont get it please help me and my logs contains the date format dd-mm-yy 

[livehybrid]

Hi @harman 

If your dates are in dd-mm-yy  format then you need to specify a TIME_FORMAT value for your sourcetype, how you do this will depend on your setup - are you using a single instance through the UI to add this? If so when you're adding through the "Add Data" section then add the following:

TIME_FORMAT=%d-%m-%y 

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[harman]

And I am uploading the data through "Add Data" and that file is 350 mb large file and the limit is 500 mb for ingestion, But it is 100% valid and your very-very thanks for replying me!!

[harman]

Ok I'll try this and verify that it works or not.