- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
I have a question for my understanding. Kindly help.
You had data in the past, one fine day if you see there is no data, how do you troubleshoot?
Regards
Suman P.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This page in Splunk Docs is a good starting point:
https://docs.splunk.com/Documentation/Splunk/latest/Troubleshooting/Cantfinddata
In the end in boils down to understanding how exactly that data is supposed to come into splunk and then in a structured way troubleshoot which of the components in the chain that handles that data ingest is broken. The exact steps will differ depending on the ingest mechanism.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This page in Splunk Docs is a good starting point:
https://docs.splunk.com/Documentation/Splunk/latest/Troubleshooting/Cantfinddata
In the end in boils down to understanding how exactly that data is supposed to come into splunk and then in a structured way troubleshoot which of the components in the chain that handles that data ingest is broken. The exact steps will differ depending on the ingest mechanism.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
Please give the answer in couple of lines for both the scenarios. For
1. Data from a certain date or certain sourcetype or index is missing
2. All the data is missing
Regards
Suman P.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Check retention periods for your indexes if data past a certain date is missing
Try loosening the filters on your searches to see if the data appears
Check the status of the indexes (how much data do they have in them)
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You are going to have to be more specific - is it that all of your data is "missing" or only prior to a particular point in time? Is it that some data is found by some searches but not by others? Can you narrow down the circumstances which lead to the missing data?