topic Re: Data is not being indexed? in Getting Data In

Data is not being indexed?

abhi04 — Sat, 17 Feb 2018 16:03:41 GMT

I can't see my data being indexed. I have checked the outputs and inputs .confirm and the correct server and ports is mentioned.
What all can be checked apart from this to triage.

Re: Data is not being indexed?

micahkemp — Sat, 17 Feb 2018 18:12:45 GMT

Are you running a single instance, or is your indexer separate from your search head? Is the data you're attempting to index on your indexer, search head, or a separate forwarder?

Re: Data is not being indexed?

abhi04 — Sat, 17 Feb 2018 18:17:49 GMT

A separate indexer ,search head and forwarder.

Re: Data is not being indexed?

micahkemp — Sat, 17 Feb 2018 18:18:29 GMT

And where is the data you're trying to index?

Re: Data is not being indexed?

abhi04 — Sat, 17 Feb 2018 18:20:35 GMT

In an application server

Re: Data is not being indexed?

micahkemp — Sat, 17 Feb 2018 18:29:14 GMT

Is that application server running a Splunk forwarder? If not, what method are you method are you intending to use to get its data?

Re: Data is not being indexed?

adonio — Sat, 17 Feb 2018 19:11:54 GMT

hello there,

start with this link:
https://docs.splunk.com/Documentation/Splunk/7.0.1/Troubleshooting/Cantfinddata
please share what are your findings and also if you still cant solve it

hope it helps

Re: Data is not being indexed?

skoelpin — Sat, 17 Feb 2018 21:55:59 GMT

You should check what the logs say.

*nix
/opt/splunk/var/log/splunk/splunkd.log

Windows
C:/Program Files/Splunk/var/log/splunk/splunkd.log