index=main not working

aschampion — Tue, 18 Feb 2025 18:52:43 GMT

Hello! I hope you can help! I have installed splunk enterprise 8.12 on my MAC OS 14.6.1 to study for an exam. Splunk installed fine. However the lab asked me to create an app called "destinations" which i did and i set the proper permissions. However, when i go to the app in the search head and type "index=main" it sees it but doesn't display any records. I have copied down eventgen to the samples folder in Destinations folder in the samples folder and copied the eventgen.conf to the local folder as directed but it still does not display.

I also see that the main index is enabled in indexes using theb $SPLUNK_DB/defaultdb/db

it also shows that it indexed 1mg out of 500gb.

I have a feeling that its something obvious but im not seeing it.

I really need this lab to work can you assist? I used SPLK-10012.PDF instructions. not sure if you have access to that. i pulled down the files fro github - eventgen.

Maybe this is an easy fix?

Thank you

Re: index=main not working

splunkreal — Thu, 27 Feb 2025 22:24:21 GMT

Hello, is it solved? Did you check splunkd.log for warnings/errors?

Re: index=main not working

isoutamo — Fri, 28 Feb 2025 15:32:59 GMT

Have you activated eventgen's inputs on Splunk side?

topic Re: index=main not working in Splunk Enterprise

index=main not working

Re: index=main not working

Re: index=main not working