Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: Data indexed but not displayed in Search
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How are you trying to search for it? Perhaps the best way to check would be to do a search for source=*FILENAME.CSV (case sensitive) over all time - this will show if it has been indexed or not, it could be that its assigned a timestamp based on a value within the CSV and stuck it somewhere in the past.
It should also be showing on the Search app summary page, is any data showing here? Its possible that it hasn't indexed it correctly, in which case we will have to start looking elsewhere..
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How are you trying to search for it? Perhaps the best way to check would be to do a search for source=*FILENAME.CSV (case sensitive) over all time - this will show if it has been indexed or not, it could be that its assigned a timestamp based on a value within the CSV and stuck it somewhere in the past.
It should also be showing on the Search app summary page, is any data showing here? Its possible that it hasn't indexed it correctly, in which case we will have to start looking elsewhere..
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
As I said above, you need to use source=*FILENAME.CSV (case sensitive). Also, you didn't mention what you can see in the summary view on the search app?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi Mate,
My file name which i selected name was Call_Details.csv, i have given as source=call_details.csv but nothing displayed. But when i selected it showed successfully indexed, dont know where the prob is..
Else my scenario is to continously monitor a particular directory or file.. what steps i need to follow and my OS is Windows.. Do i need to update anything in inputs.conf file..?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
hi Drainy, am trying to upload a .csv file from a directory and i want to keep on indexing when there is any change in the file,
step 1:
selected required file
Step2:
opted for "Continously index data..."
Source Type: Manual (CSV)
Index: Default
Once i have the done the seetings and saved its showing data indexed successfully but not able to see the file in search area..
How can i assign it to my role (steps plz)
Let me know if for any queries..
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Could you give us some more info? such as your inputs... are you putting it into a new index? By default Splunk will only search the default (main) index so you need to add it to your role or to the search string to find the data.
When posting a question try to give as much information as possible, we can't see your setup so, "its not being displayed" doesn't give us much to go on 🙂
Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain
Splunk Lantern’s Guide to The Most Popular .conf25 Sessions
Unlock What’s Next: The Splunk Cloud Platform at .conf25
