Hi
I started the Fundamentals 1 training a couple a weeks ago. I had to stop until today. So I started up by reviewing search but all my searches result in no results found. Searching had worked fine in my first time a couple of weeks ago.
The search window shows that there is data to search. This data was sample data from the tutorial.
What could have changed in 10 days? What can be done to fix this. Thanks so much!!
Jeff
Have you tried searching All Time? It's possible the sample data is old now and you need a larger search window. It's also possible the data has a short retention time and may be gone completely.
I was suspecting that but when I enter the search tab, it lists in what to search, 239,625 events. But I will try entering the data again. Good practice I guess. Thanks for the quick reply.
also with all time settings, try searching for index=*
Thanks for the quick reply but .. Yes indeed I set it to all time and even tried searching for *
Then I can only conclude the data is gone and you'll have to start over.
Jeff, I removed your email address from the question. It's not a good idea to include personal information in this public forum.
thanks. Did not realize it was a problem.