When I first setup Splunk on my local machine (Playing around with it as I learn it), I could search for '*' and get shown all events for the time period. Then suddenly, I got no data back. I thought my events were lost. After lots of container deletes and creation ( Running in Docker), I eventually realised that my data was their, but ONLY when i searched for it exactly. What is going on?
This is an image of four searches, but only the specific ones return data. Why has '*' stopped working?
Most probably, "Indexes searched by default" does not have required indexes.
In Access Controls -> Roles, please check the Indexes searched by default section and make sure you have indexes added. This should be done for the specific roles
Most probably, "Indexes searched by default" does not have required indexes.
In Access Controls -> Roles, please check the Indexes searched by default section and make sure you have indexes added. This should be done for the specific roles
Wow, amazing, that was it. I would have never found that setting, thank you.