Results only showing up in realtime

[andrew_rush]

We've just added a new index and under the manager menus it shows that there are events and data in the index. When we run a realtime search, we can see the results as the come in but only those generated after the search was started. And when we do just a normal time frame search there are no results at all.

We are using a Universal forwarder, v5.0.3 and the indexer is v5.0.3

Has anyone seen this issue before? All the conf files look similar to existing forwarders.

[LukeMurphey]

Check the timestamps. A real-time search with no time defined (all-time) will show all events as they come in regardless of the time field. This can find events whose times are off. Take a look at the _indextime field and compare it with the _time field to see if the events have an extracted time that is incorrect. These fields are hidden so you have to use eval to get them to display. Below is an example search that creates a delay field containing the difference between the index time and extracted time (in seconds):

| eval indextime=_indextime | eval time=_time | eval delay=indextime-time

The delay field should be a small positive number. If it is negative, then the event has a timestamp in the future.

[linu1988]

So are you suggesting they are not indexed?

Other scenario is like , you could see the events in realtime, but the indexed event may have a different timestamp than the actual event time. Search for for the whole data, check if the data which you saw in the rt search are present or not...