Splunk Search

How to increase the immediate availability of searchable data in an indexer clustering environment?

Madhan45
Path Finder

The event had indexed at 10:00 AM, but when I search for the same data at 10:15, I just got "No results found".
However, when I search at 10:20, I got the data. (I didn't make any changes on the search which I ran)

How to increase the immediate availability of data in an indexer clustering environment?

0 Karma

ryanoconnor
Builder

Did you receive any sort of errors when you ran the second search? This doesn't sound like any sort of expected behavior.

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Developer Program!

Hey Splunk community! We are excited to announce that Splunk is launching the Splunk Developer Program in ...

Splunkbase Year in Review 2024

Reflecting on 2024, it’s clear that innovation and collaboration have defined the journey for Splunk ...

Developer Spotlight with Brett Adams

In our third Spotlight feature, we're excited to shine a light on Brett—a Splunk consultant, innovative ...