no results found?

[TISKAR]

Hey Splunkers:

I indexed my data, and I worked quietly, but today I ran the same query, output is : "no results found"

source="lightsaber_bis2.csv" host="PC" index="index3" sourcetype="csv"

Splunk: Splunk Entreprise.

Can you Help please.

[renjith_nair · Accepted solution]

Try changing the time range in Splunk search bar.
It's possible that you indexed the data with old timestamps and searching for latest.

Just try setting timerange to "all time" and run the search again

[TISKAR]

Thank you for your respense:

I checked, it's all temp, I loaded the data by creating another index, but when I restat the server, the event going from 11000 event to 0 event

[renjith_nair]

Check the "frozenTimePeriodInSecs" property for the index on which this is imported. This defines the data retiring policy for the index (events older than frozenTimePeriodInSecs value in sec, will get deleted).
By default its value is 188697600 which is 6 years and your data may be older that that.

[TISKAR]

Thank you for your respense:

I checked, it's all temp, I loaded the data by creating another index, but when I restat the server, the event going from 11000 event to 0 event