indexed data missing for source type

[kteng2024]

Data already been indexed for a sourcetype is missing in splunk . Can i please know how to troubleshoot the issue . events in splunk in splunk are missing for only those 2 days but events are available before and after those 2 days.

[mattymo]

Have you searched all time? Sounds like timestamp issues...

[kteng2024]

no timestamp change.

[mattymo]

what is the date of the missing data?
Is the sourcetype looking ok real time?
what is the source and sourcetype of the data. how is it collected?
Are you an admin?
Is it possible it is collected in daily files and rolled over, and somehow those two days were lost, or need to be re-indexed?

#hunt for the source file, may show you exactly where to find the raw data, if meta is not overwritten
    index=<yourIndex> sourcetype=<yourSourcetype> | stats count by source | head 10000

#Look at the configuration for the particular sourcetype. 
    ./splunk btool inputs list <yourInput>  --debug
    ./splunk btool props list  <yourSourcetype> --debug


#if you get to the point you are chasing buckets
    check out | db inspect

[hardikJsheth]

The reason why data is missing will depend on how its getting indexed

If you are monitoring a file which is managed via logrotation, then problem can be with the filechecksum. Splunk may have already indexed data from the beginning of the file and file was rotated which may have resulted in data not getting indexed from rest of the file.