Splunk Search

How to increase the immediate availability of searchable data in an indexer clustering environment?

Madhan45
Path Finder

The event had indexed at 10:00 AM, but when I search for the same data at 10:15, I just got "No results found".
However, when I search at 10:20, I got the data. (I didn't make any changes on the search which I ran)

How to increase the immediate availability of data in an indexer clustering environment?

0 Karma

ryanoconnor
Builder

Did you receive any sort of errors when you ran the second search? This doesn't sound like any sort of expected behavior.

0 Karma
Get Updates on the Splunk Community!

Your Guide to Splunk Digital Experience Monitoring

A flawless digital experience isn't just an advantage, it's key to customer loyalty and business success. But ...

Data Management Digest – November 2025

  Welcome to the inaugural edition of Data Management Digest! As your trusted partner in data innovation, the ...

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...