What happened to the data?

[SumanPalisetty]

Hi,

I have a question for my understanding. Kindly help.

You had data in the past, one fine day if you see there is no data, how do you troubleshoot?

Regards

Suman P.

[FrankVl · Accepted solution]

This page in Splunk Docs is a good starting point:

https://docs.splunk.com/Documentation/Splunk/latest/Troubleshooting/Cantfinddata

In the end in boils down to understanding how exactly that data is supposed to come into splunk and then in a structured way troubleshoot which of the components in the chain that handles that data ingest is broken. The exact steps will differ depending on the ingest mechanism.

[SumanPalisetty]

Hi,

Please give the answer in  couple of lines for both the scenarios. For

1. Data from a certain date or certain sourcetype or index is missing

2. All the data is missing

Regards

Suman P.

[ITWhisperer]

Check retention periods for your indexes if data past a certain date is missing

Try loosening the filters on your searches to see if the data appears

Check the status of the indexes (how much data do they have in them)

[ITWhisperer]

You are going to have to be more specific - is it that all of your data is "missing" or only prior to a particular point in time? Is it that some data is found by some searches but not by others? Can you narrow down the circumstances which lead to the missing data?