Splunk Search

Gap in data after System event

ironhalo
Explorer

We had an event on our splunk server, and there's a gap in some of the logs. The logs are continually written to on a daily basis, I'm not sure why splunk is not parsing the missing data. How can I get the missing data back in without manually adding it?

Tags (3)
0 Karma

cvajs
Contributor

copy out the data into a new file, then index that file into the same index, etc.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Splunk Cloud Application Management in Terraform

Register   On Tuesday, August 4 at 11AM PDT / 2PM EDT, we’re diving into how you can bring Infrastructure as ...

Get Agentic with Splunk Lantern: Connect to Cisco Cloud Control, Transform ...

Splunk Lantern is Splunk’s customer success center that provides practical guidance from Splunk experts on key ...

July Community Events: Master ITSI 5.0 & Automate Splunk

Struggling with alert fatigue or feeling like you're spending more time on infrastructure maintenance than ...