topic Re: Installed Splunk but no Data! in Installation

Installed Splunk but no Data!

canton — Fri, 10 Dec 2010 01:25:20 GMT

I have installed Splunk on server and can login to splunk and browse but no data is showing in search section waht so ever.

I have also configured via Manager » Data inputs » Files & Directories.

But still no luck what could be wrong?

Thanks in advance

Re: Installed Splunk but no Data!

Genti — Fri, 10 Dec 2010 02:02:02 GMT

So, when you go to Manager » Data inputs » Files & Directories do you see the file/directory you added as listed? And does it show a number of files next to it?

Is this directory perhaps owned by a different user and the splunk service does not have appropriate permissions to monitor/read the files within?

Are you searching using the "all time" time-range? Perhaps this is historic data and not showing up in the timeframe you are searching?

Lastly, if you search for "index=_internal", do you see any data show up?

Re: Installed Splunk but no Data!

canton — Fri, 10 Dec 2010 07:13:32 GMT

mmm after doing what you advised "index=_internal" all seemed to work or it may have been a coincidence.

regardless thank you for your help

Re: Installed Splunk but no Data!

Genti — Fri, 10 Dec 2010 08:52:56 GMT

well, no, you have to be careful here. This means that you are receiving internal data. What about your OTHER data. Are you receiving the logs from the files that you already included in your data inputs?