Splunk Search

Search Help

mkhatri
Loves-to-Learn

Hello , I am trying to get the sales report for 3 months but the search results only gives the result for last 15 days. Results before 15 days are all zeros. the job notification shows :

[pdx-nav-non-prod-splunk-idx-240-132] Your search has been restricted to a time span of 1296000 seconds. i.e. 15 days.

So my question is how can i get the full report for 3 months or how can i increase the time span of a search .

Labels (2)
0 Karma

mkhatri
Loves-to-Learn

Yes .Maybe that's why i didn't have index on my  splunk settings. Thank you @michel_wolf .

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @mkhatri,

what's the retention of the index containing those data?

maybe you have on that index a retention of 15 days.

In addition, could you share the search you're using?

Ciao.

Giuseppe

0 Karma

mkhatri
Loves-to-Learn

Hii ,  i am not able to see the index on my splunk settings. The search i am using is :

index=nav_app_message_gateway event=sentMessageTo* status=200 | timechart count by templateId
0 Karma

michel_wolf
Path Finder

Hi,

I think you need to ask your splunk admin, maybe you have some role restrictions here like:

michel_wolf_0-1626103106716.png

 

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...