Knowledge Management

index is not showing 100%

sasankganta
Path Finder

Index=X sourcetype=Y cribl_pipe=Z when I ran for 1week and 24hrs it showed index , sourcetype field with 100%

Index=X sourcetype=Y cribl_pipe=Z when I ran for 2weeks and 1month  index , sourcetype field is not showing up 100% can some please suggest on this.

I'm searching for single index and single sourcetype but for 1week it's showing 100% field value, for 2 weeks it's not showing 100% what can be the issue ?

Labels (1)
Tags (1)
0 Karma

sasankganta
Path Finder

How can I identify raw events which are not indexed source tcp:9997 port 

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.