Splunk Search

Added data issues

malleva
New Member

Greetings,

I was told by my instructor to use your product for an assignment, however, I am not getting the results that are shown.  It seems as if Splunk is not reading the data from my files.  I was able to add the data but when I perform the search, it returns zero results.  Attached is a screenshot of what it should look like.  How do I accurately import my files?  

What search results should reflect.png

 

Here is a screenshot of what my results are showing:

What my results are showing.png

Please help.

 

Thanks,

Melissa

Labels (1)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

Do  this

| tstats count where index=* earliest=1 latest=now() by index _time span=1d

 to see if you have data in any of your indexes. (And yes, the pipe character at the beginning is important)

If you do, you're probably searching using wrong timerange and that's why you're not getting any results.

If you don't get any results from the search above, you haven't imported the data properly.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...