We have been collecting syslog data on our hosts for the past 5 years or so. Syslog is in our 'main' index, along with other events. We performed a query today and noticed that all of our data in 'main', and a few other indexes, prior to late-2018 are gone. *poof* Looking at our monitoring graphs, it looks like our disk space usage plummeted back in March, which is probably when this happened.
I have no idea where the data went. The time of the drop in disk usage does not correspond to any upgrade or maintenance during that period.
Can anyone offer suggestions on how to troubleshoot this? Is it possible that, for some reason, Splunk rolled it over to frozen? I'm grasping. Any suggestions would be appreciated.
Thanks!
