In the "New Search" window, why does typing * result in "No results in current time range"?

[harry_hodge]

I have tried multiple time ranges. no luck.
Cisco app shows data coming in.
License section of Splunk Utilization Monitor app shows data coming in.
Just do not seem to be able to look at raw data.

[somesoni2]

If you just search *, you'd get data for the Indexes searched by default set in your role/user profile, which set while creating role. Check if there was default index assigned to your user role.

http://docs.splunk.com/Documentation/Splunk/6.3.0/Security/Addandeditroles#Add_or_edit_a_role

[somesoni2]

BTW, you should specify an index, and possibly other filters, for better search performance.

[harry_hodge]

Thanks. We do specify indexes by user. However all indexes go removed for admin. Wonder which admin changed that?

[woodcock]

Try this:

index=*

And make sure that you have set your search mode to verbose.