https://community.splunk.com/t5/Getting-Data-In/where-is-the-forwarded-data/m-p/16577#M2021 <P>I configured a linux forwarder. The receiving one is a windows splunk server.</P> <P>The splunkd.log says that events are dropped, how do I don't see the linux datainputs on windows server. How do I check the datainputs that were specified on linux instance are forwarded properly. </P> Thu, 01 Jul 2010 02:34:37 GMT mihika 2010-07-01T02:34:37Z https://community.splunk.com/t5/Getting-Data-In/where-is-the-forwarded-data/m-p/16577#M2021 <P>I configured a linux forwarder. The receiving one is a windows splunk server.</P> <P>The splunkd.log says that events are dropped, how do I don't see the linux datainputs on windows server. How do I check the datainputs that were specified on linux instance are forwarded properly. </P> Thu, 01 Jul 2010 02:34:37 GMT https://community.splunk.com/t5/Getting-Data-In/where-is-the-forwarded-data/m-p/16577#M2021 mihika 2010-07-01T02:34:37Z https://community.splunk.com/t5/Getting-Data-In/where-is-the-forwarded-data/m-p/16578#M2022 <P>Do you have an "os" index created on your windows splunk instance?</P> <P>If you have the <CODE>unix</CODE> app setup on your linux splunk instance, it will automatically use the "os" index as a default destination for some events. However, this is not setup with this "windows" app or by splunk's default configs so you may need to create this index manually.</P> <P>On your indexer, go to <EM>Manager » Indexes » Add New</EM> and call the index "os", then restart splunk.</P> Thu, 01 Jul 2010 04:13:35 GMT https://community.splunk.com/t5/Getting-Data-In/where-is-the-forwarded-data/m-p/16578#M2022 Lowell 2010-07-01T04:13:35Z