Splunk Search

Gap in data after System event

ironhalo
Explorer

We had an event on our splunk server, and there's a gap in some of the logs. The logs are continually written to on a daily basis, I'm not sure why splunk is not parsing the missing data. How can I get the missing data back in without manually adding it?

Tags (3)
0 Karma

cvajs
Contributor

copy out the data into a new file, then index that file into the same index, etc.

0 Karma
Get Updates on the Splunk Community!

New Year, New Changes for Splunk Certifications

As we embrace a new year, we’re making a small but important update to the Splunk Certification ...

Stay Connected: Your Guide to January Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...

[Puzzles] Solve, Learn, Repeat: Reprocessing XML into Fixed-Length Events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...