Data vanished from search

[Kindred]

Hey,

We have a 20GB index that is showing an earliest date of 27th Dec 2013. The current size of the index is about 19.995GB, so this leads me to believe it is full and rolling data for deletion, with the earliest entry still being over 3 months ago.

However, when I search for events from last month (say 1st Feb) I don't see any data at all.

What could have caused the data to be removed from search, given the index thinks its has data going back 3 months?

How can I verify the current retention time? I have a feeling the earliest date reference in the index configuration page is lying to me.

[bshuler_splunk]

Odds are you search is bad. When I am not seeing what I expect, I eliminate constraints until I see the data. Most times I added a constraint without understanding it fully. I would try a search like this:

index=main | stats min(_time) as time | eval time=strftime(time, "%H:%M:%S %m-%d-%y")

over all time, and see what I get.

[Kindred]

I have literally just specified index=myindex and set the custom timeframe.

I have a feeling the "earliest date" column in the index configuration is lying to me, and it is actually rolling over faster than I thought.