https://community.splunk.com/t5/Alerting/No-Data-in-Search-App/m-p/512844#M9416 <P>I installed a Splunk search head on my Windows machine.&nbsp; I installed a forwarder on a RHEL8 VM hosted by the same machine.&nbsp; The forwarder monitors /var and /etc.&nbsp; The systems can ping each other, and ports 9997 and 8089 are open.&nbsp; I have restarted Splunk on both systems.&nbsp; No errors occurred during installation or on any other operation, but no data appears on the search head.</P><P>Please help.</P> Thu, 06 Aug 2020 19:03:14 GMT macleadg 2020-08-06T19:03:14Z https://community.splunk.com/t5/Alerting/No-Data-in-Search-App/m-p/512844#M9416 <P>I installed a Splunk search head on my Windows machine.&nbsp; I installed a forwarder on a RHEL8 VM hosted by the same machine.&nbsp; The forwarder monitors /var and /etc.&nbsp; The systems can ping each other, and ports 9997 and 8089 are open.&nbsp; I have restarted Splunk on both systems.&nbsp; No errors occurred during installation or on any other operation, but no data appears on the search head.</P><P>Please help.</P> Thu, 06 Aug 2020 19:03:14 GMT https://community.splunk.com/t5/Alerting/No-Data-in-Search-App/m-p/512844#M9416 macleadg 2020-08-06T19:03:14Z https://community.splunk.com/t5/Alerting/No-Data-in-Search-App/m-p/512852#M9417 <P>What about permissions?</P><P>may be user which is running splunk forwarder doesn’t have read access to those files under var.</P><P>with root on rhel:</P><P>setfacl -m u:splunkuser:r /var/log/secure<BR /><BR /></P><P>restart splunk you should see ssh logs from rhel8.</P> Thu, 06 Aug 2020 19:23:51 GMT https://community.splunk.com/t5/Alerting/No-Data-in-Search-App/m-p/512852#M9417 thambisetty 2020-08-06T19:23:51Z