Splunk Search

indexed data missing for source type

Path Finder

Data already been indexed for a sourcetype is missing in splunk . Can i please know how to troubleshoot the issue . events in splunk in splunk are missing for only those 2 days but events are available before and after those 2 days.

0 Karma

Splunk Employee
Splunk Employee

Have you searched all time? Sounds like timestamp issues...

0 Karma

Path Finder

no timestamp change.

0 Karma

Splunk Employee
Splunk Employee

what is the date of the missing data?
Is the sourcetype looking ok real time?
what is the source and sourcetype of the data. how is it collected?
Are you an admin?
Is it possible it is collected in daily files and rolled over, and somehow those two days were lost, or need to be re-indexed?

#hunt for the source file, may show you exactly where to find the raw data, if meta is not overwritten
    index=<yourIndex> sourcetype=<yourSourcetype> | stats count by source | head 10000

#Look at the configuration for the particular sourcetype. 
    ./splunk btool inputs list <yourInput>  --debug
    ./splunk btool props list  <yourSourcetype> --debug


#if you get to the point you are chasing buckets
    check out | db inspect
0 Karma

Motivator

The reason why data is missing will depend on how its getting indexed

If you are monitoring a file which is managed via logrotation, then problem can be with the filechecksum. Splunk may have already indexed data from the beginning of the file and file was rotated which may have resulted in data not getting indexed from rest of the file.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!