topic hosts not visible in Splunk Search

hosts not visible

rajballa — Tue, 23 Jan 2018 02:48:36 GMT

Hi,

Configured splunk universal forwarders on windows & linux hosts through splunk deployment server, which are visible, when check under settings--> Forward Mgmt but when trying to check the hosts under Search & Reporting-->Data Summary when clicked, the hosts are not visible.

Appreciate if any one can help with how to add or configure hosts to be visible under Data summary.

Thanks in advance

Re: hosts not visible

p_gurav — Tue, 23 Jan 2018 12:53:33 GMT

Hi,

Is it single server deployment OR distributed environment?

Re: hosts not visible

mayurr98 — Tue, 23 Jan 2018 13:08:42 GMT

hey @rajballa

You will be able to see hosts under data summary only when you are monitoring any files.From the description you have given, I think you have only configured forwarders.You need to add monitor inputs as well.
Well if you want to see if your forwarder is configured properly then you can run this command.If you getting data after running this command means you have configured your forwarder correctly

index=_internal host=<your_host>

let me know if this helps!

Re: hosts not visible

rajballa — Tue, 23 Jan 2018 23:19:01 GMT

Hi mayurr98,

thanks, using the above command it displays the data if I set the time as "Last 30 days". but as said when I click on Data Summary button, the hosts are not visible.

Can you help with the steps on how to add monitor inputs.

Thanks in advance

Re: hosts not visible

rajballa — Wed, 24 Jan 2018 03:17:01 GMT

It is a single server deployment

Re: hosts not visible

mayurr98 — Wed, 24 Jan 2018 06:07:10 GMT

follow this doc if you want to index local files from the indexer
http://docs.splunk.com/Documentation/SplunkCloud/6.6.3/Data/MonitorfilesanddirectorieswithSplunkWeb

if you have forwarder which is at the remote location then follow this doc
https://docs.splunk.com/Documentation/SplunkCloud/6.6.3/Data/MonitorfilesanddirectoriesusingtheCLI#Example_1:_Monitor_files_in_a_directory

Re: hosts not visible

rajballa — Wed, 24 Jan 2018 06:47:28 GMT

Thank you mayurr98.
I have the same document too. Since I am new to this splunk, when trying to use the steps specified in the said doc, not able to understand - what to select - when click browse button under files and directories.

Not able to select the host.

Re: hosts not visible

mayurr98 — Wed, 24 Jan 2018 07:07:26 GMT

you are confusing your self if your host is at the remote location i.e. on the forwarder then you have to do using CLI. you need to have a file to index something. refer the second doc that I gave.

you need to execute ./splunk add monitor <path of file> on the forwarder.
and you do not need to select the host . Splunk will take it automatically. using Splunk web you can monitor files of the local machine only.and there as well do not need to select any host.
If you want to load any sample data then look for below doc
https://docs.splunk.com/Documentation/SplunkCloud/6.6.3/PivotTutorial/GetthetutorialdataintoSplunk