topic Re: help on splunk index not working in Splunk Dev

help on splunk index not working

jip31 — Tue, 26 Sep 2023 15:45:37 GMT

we have create new index on our platform but they collect any data

The inputs.conf stanza are welll configurated with the new index name but our index are empty

So i try to list the check to do in order to make our index working

thanks

Re: help on splunk index not working

richgalloway — Tue, 26 Sep 2023 16:59:24 GMT

How and where did you create the index? It must be on the indexers and (optionally) on the search heads. If the index was added by editing indexes.conf then the Splunk instances must be restarted.

Ensure the inputs.conf files use the *exact* same index name that was created. Also, be sure to use the right index name when searching for data.

Check splunkd.log to see if the indexers are reporting errors writing to the new index.

Re: help on splunk index not working

jip31 — Wed, 27 Sep 2023 07:16:48 GMT

They have been created on indexers and the instance has been restarted

The index name is the same

Now i have a message issue when I am doing index=*

Message "Serach not executed: The minimum free disk space (5000MB) reached for opt/splunk/var/run/splunk/dispatch/

What do you think about this?

Re: help on splunk index not working

PickleRick — Wed, 27 Sep 2023 07:26:37 GMT

We think that you need some maintenance because you're running out of disk space.

Anyway, searching for raw events across all indexes (index=*) is very ineffective and generally should not be used at all. Typically you either look for some high-level stats which can be obtained much more effectively with tstats command or you should be way way more specific about your searching criteria.