Missing logs

[BRFZ]

Hi everyone, 

I'm facing an issue on my Splunk environment and I'd like your advice.

After an upgrade, I noticed that I still had to restart/start/stop the Splunk process using sudo (even though before the upgrade it was already running under the correct user : USERX).

To address this, I stopped the Splunk on Indexers (not at the same time) and reassigned Splunk to run under USERX.

After this operation, I realized that one full day of logs is missing.

The issue is that before making this change, I didn't verify whether the logs for that specific day already existed, so I can't say for sure if the gap appeared exactly at that moment.

If anyone has seen something similar or has any ideas, I'd really appreciate your help.

Thank you in advance.

[livehybrid]

Hi @BRFZ 

If youve been periodically running the indexers under a different user then I suppose there is a chance that the permissions on the buckets for that period of time are owned by a user that Splunk running under the other user cannot see. 

I would suggest checking the ownership of all buckets to ensure they are owned by the user that Splunk is running as. Typically this would be in $SPLUNK_HOME/var/lib/splunk/<indexName>

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[BRFZ]

Hi @livehybrid 

Thank you for your response. I have verified this point, and the ownership of all buckets is set to the user that Splunk is running as.