First, determine if the data loaded and if so where it went. Run the following searching index=* host= and set your time picker to all time. - searching for index=* will determine if the data got loaded under a different index. - setting the time picker to all time, this will bring back data even if the time is being parsed incorrectly or if the timestamps are old If the above search returns data, run it again and add a "OR host=" Then compare the differences in the returned data fields for the two data sets and see where they differ. ... View more