topic Re: Data doesnt show up on the screen in Getting Data In

Data doesnt show up on the screen

fkaanuslu — Thu, 19 Aug 2021 16:29:05 GMT

Hi I have two linux virtual machines and i am trying to use splunk forwarder one linux to another. I am getting that "waiting for the results problem".

How can i fix this ?

Thnx a lot

Re: Data doesnt show up on the screen

richgalloway — Thu, 19 Aug 2021 20:18:52 GMT

Is the forwarder running? Is it configured? What is in outputs.conf?

Don't waste your time with the Data Summary screen. Go to the Search & Reporting app and run a search to find the data.

Re: Data doesnt show up on the screen

SanjayReddy — Mon, 23 Aug 2021 04:38:10 GMT

@fkaanuslu

Can you search for data in search and reporting on search head using following query

source=/var/log/auth.log if you are not able to see any data

run following command on forwarder where inputs configured to check active outputs configuration

/opt/splunkforwarder/bin/splunk list forward-server
it might ask to enter splunk admin crdentials

One doubt from my side

IP that you configured to send the data is indexer/search head or forwarder?.

if you tryitng to send the data to another forwader you wont be able to see any data on forwarder, you need to search data in splunk search head

Re: Data doesnt show up on the screen

isoutamo — Mon, 23 Aug 2021 07:14:28 GMT

you could list all your monitors on UF with command:

splunk list monitor

When you want to see status of those in UF you can see it with commands:

splunk list inputstatus |egrep -A5 '/var/log/auth.log'

r. Ismo