That was my issue ! I forgot I set that value to a very low value initially. I had set frozenTimePeriodInSecs under "index specific defaults" in my indexes.conf file to 10800, just 3 hours worth of indexing . Set it to this because I was worried I would go over go over the data limit. I read something about the limits and just wanted to be extra careful I wouldn't make the app stop working on me. Thank you! Still not sure why / where the dashboard went as that shouldn't be affected by this. ... View more

Yeah I have a local version of Splunk Enterprise running on my laptop. I had data from Saturday and a dashboard of charts saved. I shut down Saturday night, turned it back on Sunday and Saturday data was gone including the dashboard and charts. I understand that if you shut down the instance it won't ingest new data but the old data should remain. ... View more

Thanks, I am using Splunk Enterprise free version.. 7.3.1 Don't know if it's with the Dev license how do I find that out? I just logged in this morning and see that Sunday's data IS there from yesterday. I didn't shut down the splunk instance last night like I did Saturday night when I found the prior days data missing. I DID happen to find a "marks_dashboard" object under Settings > All Configurations. But nothing is in that XML file. ... View more

I stated initially this is a free version of splunk. There are no user level settings in this version I'm told. This is merely a free version I downloaded for home use. I have no deployment server going on here. ... View more

All prior days data is gone as well as dashboard. All I can see that remains is search history ... View more

Nope. Single splunk vm free version. Version 7.3.1 just downloaded the other day. No deployment server involved. I have my home Firewall sending udp syslog to this single splunk instance running on a VM on my laptop. Really simple setup. ... View more

Don't know how I could have used up the index space I turned the splunk vm off yesterday after working with it. Turned it back on this morning and hokus pokus happened.. puff all gone. I don't have much data being sent to it. Just some logs from my home firewall is all so it's very minimal. I have only have a couple of home computers and phones so the data is very minimal. How do you limit the index size ? I did find something alarming. Under Settings > Monitoring > Indexing > Indexes and Volumes > Index and Volumes Instance. Event Indexes Only. I don't see ANY indexes listed. Index(0) is shown. I'm guessing this is bad. Settings > User Interface (under the KNOWLEDGE topic) > Views. I see many items here including alerts, alert, charting, data_model_editor, etc.. I see two "dashboard" , "dashboards", "dashboard_live". Some are sharing APP, one is sharing GLOBAL. I opened each of them. Some are short XML files and a couple are longer but none contain information I had used and no dashboards are the ones I saved; "Marks Dashboard". I saved the dashboard many times, saved and re-opened yesterday fine so this is a mystery. I did find my Search History from yesterday is still there. So that's interesting. ... View more

Nope. When I access my data through the search only this mornings data is there. I zoom out yesterday's data is totally gone. ... View more