Splunk Search

Data loss for a period of time

New Member

Hi all!

Ive got a strange problem with data loss,but not all - its just for a peroid of time.

Here is example of my index:

   coldPath = $SPLUNK_DB/myindex/colddb
    enableDataIntegrityControl = 0
    enableTsidxReduction = 0
    homePath = /mnt/db/myindex/db
    maxTotalDataSizeMB = 35840
    thawedPath = $SPLUNK_DB/myindex/thaweddb
    frozenTimePeriodInSecs = 15552000
    bucketRebuildMemoryHint = 0
    compressRawdata = 1
    enableOnlineBucketRepair = 1
    minHotIdleSecsBeforeForceRoll = 0
    rtRouterQueueSize =
    rtRouterThreads =
    suspendHotRollByDeleteQuery = 0
    syncMeta = 1
    archiver.enableDataArchive = 0

Now I can see information at 21.02. and next one starts at 02.03 ,but ive seen that information was there for all week before today.
alt text

What can it be? Ive already checked bucketmover - nothing much,2 buckets deleted but with infromation from long ago.

0 Karma


Could you provide the search you use to see the results you see?

Turn your timeline to format of "Full" , and maybe make it a Log Scale (upper left, "Format Timeline" drop-down). Does that help?

How big is the index? (Look in settings/indexes).

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...