https://community.splunk.com/t5/Getting-Data-In/Why-do-I-see-my-data-at-the-forwarder-but-not-at-the-indexer/m-p/374924#M67918 <P>I would recommend you work through the documentation <A href="http://docs.splunk.com/Documentation/Splunk/6.6.2/Troubleshooting/Cantfinddata">here</A> and if nothing helps, go to more drastic means. <span class="lia-unicode-emoji" title=":winking_face:">😉</span></P> Tue, 22 Aug 2017 19:12:37 GMT s2_splunk 2017-08-22T19:12:37Z https://community.splunk.com/t5/Getting-Data-In/Why-do-I-see-my-data-at-the-forwarder-but-not-at-the-indexer/m-p/374923#M67917 <P>I am trying to trouble shoot a data flow issue I am having. I see the data coming into my forwarder but I don't see it at the indexer. <BR /> Is this a log file I can check?<BR /> can I run a tcpdump on either forwarder or indexer to see if the data is being sent out or received ?</P> <P>Thanks!</P> Tue, 22 Aug 2017 18:02:31 GMT https://community.splunk.com/t5/Getting-Data-In/Why-do-I-see-my-data-at-the-forwarder-but-not-at-the-indexer/m-p/374923#M67917 pfabrizi 2017-08-22T18:02:31Z https://community.splunk.com/t5/Getting-Data-In/Why-do-I-see-my-data-at-the-forwarder-but-not-at-the-indexer/m-p/374924#M67918 <P>I would recommend you work through the documentation <A href="http://docs.splunk.com/Documentation/Splunk/6.6.2/Troubleshooting/Cantfinddata">here</A> and if nothing helps, go to more drastic means. <span class="lia-unicode-emoji" title=":winking_face:">😉</span></P> Tue, 22 Aug 2017 19:12:37 GMT https://community.splunk.com/t5/Getting-Data-In/Why-do-I-see-my-data-at-the-forwarder-but-not-at-the-indexer/m-p/374924#M67918 s2_splunk 2017-08-22T19:12:37Z