Data indexed but not displayed in Search in splunk enterprise

[samsingnok52]

Hi Team,

I have successfully indexed the data but it is not getting displayed in Search, don't know what has gone wrong. Its a file-upload(one time indexing) type of data input configuration and i have created a new index for that particular file and a new sourcetype also.
I could able to see the logs while configuring the event breaking and timestamp format, but when i am searching for that particular index and sourcetype , i couldnt able to find any logs in the search head.
Kindly help me to identify the issue.

Its seems like a strange issue as iam experiencing it in even after two times reinstallation of splunk enterprise in my linux testing server.

Note: iam not experiencing this issue in any of the another linux server.

[baldwintm]

You could run a metadata search to see what time stamp is on the earliest and latest event.

| metadata type=sourcetype index=*

[DalJeanis]

I would be checking index _internal for messages showing how much data was indexed. If it doesn't show it, then it wasn't indexed. If it does show it, then you will be able to see WHERE it was indexed.

One possibility is that the user account you are using does not happen to have security access to that index.

[niketn]

@samsingnok52, would it be possible to give couple of mocked up rows from your file that you are trying to index. Please ensure to Anonymize/Mock any sensitive information. Also if possible the props.conf that you currently have.

Also have you checked index whether there are any events present. You can also use eventcount, tstats, dbinspect or metadata commands for this.

[samsingnok52]

Hi Niket,

Thanks for your comments.I will try and revert back.
As of now , I have reinstalled the splunk enterprise and trying from the scratch.....

[richgalloway]

Try expanding the time window to All Time. That will account for possible timestamp problems causing events to be indexed in the "future".

[samsingnok52]

i did searched for all time, but still couldnt able to find anything

[teunlaan]

searching "all time" is "everthing in the past till NOW".
You need to select the date in the future, like @d+10y