Splunk Search

Unused indexes: Why simple strings won't provide any events?

NizanCohen
Explorer

Hi all.

I currently experiencing an issue where simple strings won't provide any events while two weeks ago I had. Doesn't matter the time frame. Tried "All time" and still zero events.

So, I wish to see if there is an issue with an index being disable or not working properly.

 

Is there a search query I can use to find these indexes?

Labels (1)
Tags (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Go to Settings->Indexes to see if the index is disabled.  That screen also will tell you if the index has data in it.

It's possible the data you saw 2 weeks ago has aged out or was removed by Splunk to make room for new data in another index (assuming the index shares a volume with another index).

Another possibility is you no longer have access to the index.  Searching an index you aren't allowed to read will return zero results rather than an error or warning message.

---
If this reply helps you, Karma would be appreciated.
0 Karma

NizanCohen
Explorer

Doesn't seem like I have this in my settings menu..

The Splunk is not my personal but related to my workplace. Maybe I don't have the proper permissions to view the index menu?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Very possible.  And if you can't view that, you may not be allowed to read the index, either.  Contact your Splunk admin.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...