×

Join the Conversation

Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Ask a Question
Opher
Engager
Member since: ‎01-19-2026
‎03-26-2026
Community Statistics
Posts 2
Solutions 0
Karma Given 2
Karma Received 0
Member Since ‎01-19-2026
Activity Feed
Topics I've Started
View All

Re: Data Gets Deleted

by in Splunk Enterprise
‎01-19-2026 11:46 PM
‎01-19-2026 11:46 PM
I'll mention that the data disappeared from the index. Since the data I've uploaded was from 2017, I'm guessing it just got frozen. Though I didn't see a data freeze from the day I uploaded (which was yesterday) And when I changed my retention policy I noticed it came back. Weird, maybe I understood something wrong. Anyhow - seems to work now 🙂 ... View more

Data Gets Deleted

by in Splunk Enterprise
‎01-19-2026 03:13 AM
‎01-19-2026 03:13 AM
Hi, Not a pro, but I've configured a Splunk Enterprise on my non-profit's Azure server. I'm conducting an educational course, and I've uploaded some zeek logs from CIC-IDS2017 dataset. For some reason, about 60 minutes after uploading using oneshot the entire index gets deleted: /opt/splunk/bin/splunk add oneshot "$f" -index "$INDEX" -sourcetype "$st" -host "$HOST"   I really can't understand what I'm doing wrong, since the installation was really vanilla.   Can anyone help me? ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎03-26-2026 07:00 AM
Karma given to
View All