topic new index not accepting data in Getting Data In

new index not accepting data

damucka — Tue, 04 Aug 2020 14:33:47 GMT

Hello,

I am not able to get my data into the newly created "varlog" index. The index is an event index and active in the system. I am not able to see any issues with it. I have the following inputs.conf stanza:

[default]

host = ccd03v005084

[monitor:///var/log/*]

index = varlog

disabled = 0

interval = 15

sourcetype = syslog

Interesting, when I change "varlog" with "main" I am getting the data into the "main".

Can it be, that this is due to the Splunk Enterprise Trial license that I am using? Would the trial license allow creation and data indexing in the new indexes?

If not, how would I investigate it further? There is no sign of any problems neither in the splunkd.log of the forwarder nor anywhere else I checked.

Kind Regards,

Kamil

Re: new index not accepting data

gcusello — Tue, 04 Aug 2020 15:44:08 GMT

Hi @damucka,

in general, there isn't any reason because logs aren't stored in varlog index, and they are correctly stored in main index.

Could you share the indexes.conf where is defined the varlog index?

Check if the name is correct and if the folder are correctly created in file system.

The trial license has no affects on your problem.

Ciao.

Giuseppe

Re: new index not accepting data

aashiqwork — Tue, 04 Aug 2020 16:24:49 GMT

Does your varlog index has necessary permissions for indexing the data.

Thanks

Re: new index not accepting data

damucka — Wed, 05 Aug 2020 10:57:47 GMT

The name is correct and the folders are there ....

The only thing is, that this is the Kubernetes cluster so I am not sure how the interaction here is.

Re: new index not accepting data

damucka — Wed, 05 Aug 2020 10:59:41 GMT

@aashiqwork

Could you please more precisely specify where would I find the setting to permit my "varlog" index the indexing?

I thought naively if I create it in the "search" app context it would accept whatever comes ...

Kind Regards,

Kamil

Re: new index not accepting data

aashiqwork — Thu, 06 Aug 2020 11:21:49 GMT

Go to the Search Head and search with the below search (Make sure you have rights to see internal indexes data):

index=_internal | dedup host | fields host | table host

Look in the list to see if your Forwarder’s hostname is in the list, if it is present that means the Forwarder is connected.