topic Re: DATA not feeding in INDEX : Splunk in Getting Data In

DATA not feeding in INDEX : Splunk

vivekg72 — Wed, 22 Apr 2020 11:12:36 GMT

I have got 5 node SPLUNK .

NODE1 : Master + License Manager
Node 2 : Indexer - peer
Node 3 : Indexer - Peer
Node 4 : Indexer - Peer
Node 5 : Search head

All is working fine . Now I need to create a new index for test purpose . and push one file in that index

Thus I have done following :

In master Node , We have a file called indexes.conf under :
/apps/splunk/etc/master-apps/app-infrastructure-loganalysis/local

I have added a few index lines :
[indexwinelksynclogs]
homePath = /data/splunk/indexwinelksynclogs/db
coldPath = /data/splunk/indexwinelksynclogs/colddb
thawedPath = /data/splunk/indexwinelksynclogs/thaweddb
repFactor = auto

Re: DATA not feeding in INDEX : Splunk

vivekg72 — Wed, 22 Apr 2020 11:16:46 GMT

Therefter I did following in master :

splunk apply cluster-bundle
splunk show cluster-bundle-status

I can see new index file is deployed in All Index servers . I have restarted whole cluster
and I can see index in UI

but When I try to push data , it does not work .. nothing goes in index

Can u please help me ASAP ?

Re: DATA not feeding in INDEX : Splunk

richgalloway — Wed, 22 Apr 2020 12:47:49 GMT

Please say more about how you are pushing data and how you are searching for it. How are you specifying the index name? Are you specifying the correct index?

Re: DATA not feeding in INDEX : Splunk

vivekg72 — Wed, 22 Apr 2020 12:55:37 GMT

I have added following lines in input.conf of splunk forwarder

[monitor://D:\PTP\Daily*.csv]
disabled = false
sourcetype = indexwinelksynclogs
index = indexwinelksynclogs

Re: DATA not feeding in INDEX : Splunk

vivekg72 — Wed, 22 Apr 2020 12:56:41 GMT

There are two more stanza in input file ( using old indexes ) and I can see data in those indexes updated regularly

but not in new Index .