Tsearch free manual#

See Add and edit roles in Splunk Web in Securing Splunk Enterprise for more information.Р”Вouble check the time range that you're searching. Your permissions can vary depending on the index privileges or search filters. For information about troubleshooting data input issues, see Troubleshoot the input process in the Getting Data In manual.Р”Вo your permissions allow you to see the data? For more information about roles, refer to Add and edit roles with Splunk Web in the Securing Splunk Enterprise manual. You might want to add the os index to the list of default indexes for the role you're using.

Tsearch free manual#

See Retrieving events from indexes in the Search Manual for more information. If you're not finding data that you're certain is in Splunk, be sure that you're looking at the right index. Some apps, like the *nix and Windows apps, write input data to a specific index (in the case of *nix and Windows, that is the 'os' index). Review this topic about object ownership and this topic about configuration file precedence in the Admin Manual for information about where Splunk writes knowledge objects such as scheduled searches. You can also view, move, or modify them in Splunk Web or in nf. Saved searches that were previously scheduled by other users are still available, and you can run them manually as required.

Splunk Free does not support multiple user accounts, distributed searching, or alerting. Are you searching for events and not finding them, or looking at a dashboard and seeing 'No result data'? Here are a few common mistakes to check.