https://community.splunk.com/t5/Getting-Data-In/Why-am-I-unable-to-see-the-forwarder-but-data-is-being-received/m-p/291397#M55541 <P>You are right Adonio, when I run this query I get this result.</P> <P>What I meant the "Search" page which shows all Hosts added,...and the moment I have the message "No data has been added",,,,whereas I should have the hostname on my cisco device.</P> <P>Any idea ?</P> Fri, 12 May 2017 20:42:19 GMT Lenval06 2017-05-12T20:42:19Z https://community.splunk.com/t5/Getting-Data-In/Why-am-I-unable-to-see-the-forwarder-but-data-is-being-received/m-p/291395#M55539 <P>Hi,<BR /> I setup a forwarder on a linux server and setup Splunk to listen on port 9997 and I added the index name (cisco) I previously setup into the inputs.conf file.<BR /> On the Splunk indexer, if I search "index=cisco", I can see all my data.</P> <P>However, my "Search" page is not displaying any "Hosts", any "Sources" and any "SourceTypes"....whereas I am receiving all data.</P> <P>Any idea what is wrong ?<BR /> Philippe</P> Fri, 12 May 2017 19:53:02 GMT https://community.splunk.com/t5/Getting-Data-In/Why-am-I-unable-to-see-the-forwarder-but-data-is-being-received/m-p/291395#M55539 Lenval06 2017-05-12T19:53:02Z https://community.splunk.com/t5/Getting-Data-In/Why-am-I-unable-to-see-the-forwarder-but-data-is-being-received/m-p/291396#M55540 <P>search index=cisco | head <BR /> look on the left part of the screen <BR /> the 3 fields host, source, sourcetype supposed to be there</P> Fri, 12 May 2017 20:29:06 GMT https://community.splunk.com/t5/Getting-Data-In/Why-am-I-unable-to-see-the-forwarder-but-data-is-being-received/m-p/291396#M55540 adonio 2017-05-12T20:29:06Z https://community.splunk.com/t5/Getting-Data-In/Why-am-I-unable-to-see-the-forwarder-but-data-is-being-received/m-p/291397#M55541 <P>You are right Adonio, when I run this query I get this result.</P> <P>What I meant the "Search" page which shows all Hosts added,...and the moment I have the message "No data has been added",,,,whereas I should have the hostname on my cisco device.</P> <P>Any idea ?</P> Fri, 12 May 2017 20:42:19 GMT https://community.splunk.com/t5/Getting-Data-In/Why-am-I-unable-to-see-the-forwarder-but-data-is-being-received/m-p/291397#M55541 Lenval06 2017-05-12T20:42:19Z https://community.splunk.com/t5/Getting-Data-In/Why-am-I-unable-to-see-the-forwarder-but-data-is-being-received/m-p/291398#M55542 <P>you mean the data summary button?</P> Fri, 12 May 2017 20:45:56 GMT https://community.splunk.com/t5/Getting-Data-In/Why-am-I-unable-to-see-the-forwarder-but-data-is-being-received/m-p/291398#M55542 adonio 2017-05-12T20:45:56Z https://community.splunk.com/t5/Getting-Data-In/Why-am-I-unable-to-see-the-forwarder-but-data-is-being-received/m-p/291399#M55543 <P>I mean the default page when you open Splunk: you have a list of "Hosts" , then if you click "Sources" you can see all your sources are are being indexed and finally if you click on "Sourcetypes" you can see all your sources types</P> <P>In this page, I do not have anything being displaying whereas I have data being received from a forwarder.</P> <P>Is this clearer ?<BR /> Thanks</P> Fri, 12 May 2017 20:53:43 GMT https://community.splunk.com/t5/Getting-Data-In/Why-am-I-unable-to-see-the-forwarder-but-data-is-being-received/m-p/291399#M55543 Lenval06 2017-05-12T20:53:43Z https://community.splunk.com/t5/Getting-Data-In/Why-am-I-unable-to-see-the-forwarder-but-data-is-being-received/m-p/291400#M55544 <P>hmmm, just noticed the question is tagged as splunk light.<BR /> ill place some screenshots in an answer, hopefully the UI is similar but i am not 100% sure.<BR /> anyways, i think all you need is to click the data summary button</P> Fri, 12 May 2017 22:16:44 GMT https://community.splunk.com/t5/Getting-Data-In/Why-am-I-unable-to-see-the-forwarder-but-data-is-being-received/m-p/291400#M55544 adonio 2017-05-12T22:16:44Z https://community.splunk.com/t5/Getting-Data-In/Why-am-I-unable-to-see-the-forwarder-but-data-is-being-received/m-p/291401#M55545 <P>here is in splunk enterprise, kindly assist with splunk light if its not equivalent:</P> <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/2922iD26BDA03ABF2B07A/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/2923i0F6A8E6C7AA69B2E/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> Fri, 12 May 2017 22:20:13 GMT https://community.splunk.com/t5/Getting-Data-In/Why-am-I-unable-to-see-the-forwarder-but-data-is-being-received/m-p/291401#M55545 adonio 2017-05-12T22:20:13Z