https://community.splunk.com/t5/Getting-Data-In/Forwarder-is-working-but-data-is-not-shown-in-splunk/m-p/339505#M92717 <P>There are a ton of reasons.</P> <PRE><CODE>Is splunk running? Is inputs.conf configured to send anything? Is outputs.conf configured to show where to send it? Does the forwarder have a route to the indexer hosts? Do the firewalls and other network equipment allow connections from the UF to the indexers (port 9997 or maybe 9998 or ???)? Is _time correct for your events (maybe being thrown into the future)? Are you indexers setup to receive anything? </CODE></PRE> Wed, 02 Aug 2017 03:16:36 GMT woodcock 2017-08-02T03:16:36Z https://community.splunk.com/t5/Getting-Data-In/Forwarder-is-working-but-data-is-not-shown-in-splunk/m-p/339503#M92715 <P>Hi,</P> <P>We have a setup in a remote machine that receives data from database in form of excel sheets and forwards it to Splunk environment <BR /> with the help of a universal forwarder.<BR /> But when i am searching that particular data it is not coming in splunk. Any idea why this is happening even if the .conf files are fine?</P> Tue, 01 Aug 2017 04:32:51 GMT https://community.splunk.com/t5/Getting-Data-In/Forwarder-is-working-but-data-is-not-shown-in-splunk/m-p/339503#M92715 ASISH_9 2017-08-01T04:32:51Z https://community.splunk.com/t5/Getting-Data-In/Forwarder-is-working-but-data-is-not-shown-in-splunk/m-p/339504#M92716 <P>Are you monitoring file on UF? Following are good source to debug</P> <P><A href="https://wiki.splunk.com/Community:Troubleshooting_Monitor_Inputs">https://wiki.splunk.com/Community:Troubleshooting_Monitor_Inputs</A><BR /> <A href="https://answers.splunk.com/answers/177588/how-to-debug-why-a-universal-forwarder-is-reading.html">https://answers.splunk.com/answers/177588/how-to-debug-why-a-universal-forwarder-is-reading.html</A></P> Tue, 01 Aug 2017 08:50:23 GMT https://community.splunk.com/t5/Getting-Data-In/Forwarder-is-working-but-data-is-not-shown-in-splunk/m-p/339504#M92716 hardikJsheth 2017-08-01T08:50:23Z https://community.splunk.com/t5/Getting-Data-In/Forwarder-is-working-but-data-is-not-shown-in-splunk/m-p/339505#M92717 <P>There are a ton of reasons.</P> <PRE><CODE>Is splunk running? Is inputs.conf configured to send anything? Is outputs.conf configured to show where to send it? Does the forwarder have a route to the indexer hosts? Do the firewalls and other network equipment allow connections from the UF to the indexers (port 9997 or maybe 9998 or ???)? Is _time correct for your events (maybe being thrown into the future)? Are you indexers setup to receive anything? </CODE></PRE> Wed, 02 Aug 2017 03:16:36 GMT https://community.splunk.com/t5/Getting-Data-In/Forwarder-is-working-but-data-is-not-shown-in-splunk/m-p/339505#M92717 woodcock 2017-08-02T03:16:36Z