Ahh. OK. That wasn't clear. I thought that maybe there's some "practice" environment with that training. Anyway, you can look for your data by doing either what @marnall said or do a quick summary | tstats count min(_time) as earliest max(_time) as latest where index IN (*,_*) by index sourcetype | convert ctime(earliest) ctime(latest) to see when and where your data is.  (the underscore-beginning Splunk's internal indexes are just to show you what it should look like). Run this search over All Time ... View more