topic Re: Data is not making to indexer in Getting Data In

Data is not making to indexer

ssankeneni — Fri, 05 Oct 2012 19:28:07 GMT

The Data forwarded by universal forwarder is not making to the indexer. There is no clue on splunkd.log file even. It shows that the forwarder has made a connection to indexer. Any help would be appreciated.

Re: Data is not making to indexer

Ayn — Fri, 05 Oct 2012 19:37:58 GMT

Please provide much more details on your setup - inputs, outputs, etc etc. It's impossible to help you without having any details.

Re: Data is not making to indexer

ssankeneni — Fri, 05 Oct 2012 19:44:46 GMT

I'm unable to index the data on the same splunk instance even. My inputs.conf file on the same instance. I can't see any testindex being created.
[default]
host = vm10177
[monitor:///home/ssanke/SplunkTests/logs/DistSearch]
index = testindex

Re: Data is not making to indexer

lguinn2 — Fri, 05 Oct 2012 23:19:27 GMT

First, you must create the index before you direct any inputs to the index. Go to Manager>>Indexes and create the testindex there.

Second, searches only include a default set of indexes, based on your role. When you create a new index (such as textindex), you need to add it to any roles where you wish for the new index to be searched by default. You also must include the new index in any roles that will be allowed to search it explicitly. Go to Manager>>Access Controls to edit these settings.

If you did create the testindex, try this search to see if there is anything in it:

index=testindex

You can also look at the testindex in Manager>>Indexes, which will show how many events it contains.

HTH

Re: Data is not making to indexer

ssankeneni — Tue, 09 Oct 2012 18:10:40 GMT

Thanks for the answer.. but my problem was the indexer is forwarding to another server. I removed it and it started working back. Thank you for your help.