Splunk Cloud Platform

Why is my past data not being forwarded (Cloud vs Free Instance trial)?


I setup a trial of the free Splunk Cloud instance to receive data from my web server and it sent in not only the current data but also the historical data so that I could do searches back to when the apache logs were started.

Today I installed the Splunk Free on a separate system and configured the web server to forward to it instead of the Splunk Cloud instance.

my new install is getting current live data but it is not getting the historical data to be able to do year to date searches , etc..

Did I miss something or is it a limit of the type of splunk install ( Free vs Cloud Instance Trial? )

0 Karma


The forwarder keeps track of what it's sent to be indexed so data is not duplicated (with a corresponding effect on your license). Changing the target of the forwarding does not tell the forwarder to re-index historical data.

To force the forwarder to re-index historical data you'll need to clear the "fishbucket". See https://answers.splunk.com/answers/612608/how-to-re-index-data-in-a-different-index.html

If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Splunk Security Content for Threat Detection & Response, Q1 Roundup

Join Principal Threat Researcher, Michael Haag, as he walks through:An introduction to the Splunk Threat ...

Splunk Life | Happy Pride Month!

Happy Pride Month, Splunk Community! 🌈 In the United States, as well as many countries around the ...

SplunkTrust | Where Are They Now - Michael Uschmann

The Background Five years ago, Splunk published several videos showcasing members of the SplunkTrust to share ...