https://community.splunk.com/t5/Splunk-Search/Error-to-search-data/m-p/160372#M45329 <P>Hi rajuljain19900526,</P> <P>assuming you installed the full Splunk version on both (not only the universal forwarder on your forwarding server2), then this will be the default behavior for Splunk on server2. If you want Splunk on server2 to locally index and forward the events to server1 read the docs <A href="http://docs.splunk.com/Documentation/Splunk/6.2.1/Forwarding/Routeandfilterdatad#Perform_selective_indexing_and_forwarding">http://docs.splunk.com/Documentation/Splunk/6.2.1/Forwarding/Routeandfilterdatad#Perform_selective_indexing_and_forwarding</A> </P> <PRE><CODE>Index all the data before forwarding it. To do this, just enable the indexAndForward attribute in outputs.conf. </CODE></PRE> <P>Or goto <CODE>Settings » Forwarding and receiving » Forwarding defaults</CODE> in the UI and select </P> <PRE><CODE>Store a local copy of forwarded events? </CODE></PRE> <P>Hope this helps ...</P> <P>cheers, MuS</P> Wed, 17 Dec 2014 12:24:55 GMT MuS 2014-12-17T12:24:55Z https://community.splunk.com/t5/Splunk-Search/Error-to-search-data/m-p/160371#M45328 <P>I am working on forwarder and enable my server1 as receiver &amp; server 2 as forwarder. When I am adding data in any index in server 2 , it added successfully, but I am unable to see/search any event in that index . The surprising part is I am able to see the same data in my Spunk receiver which I got from forwarder instance(i.e. server 2). Why this issue. I am unable to figure out the root cause.<BR /> I added eventlog too, but inside index showing 0 events. those log events are visible in receiver sever(server 1). Why not in server where the forwarding enabled? </P> Wed, 17 Dec 2014 12:12:16 GMT https://community.splunk.com/t5/Splunk-Search/Error-to-search-data/m-p/160371#M45328 rajuljain199005 2014-12-17T12:12:16Z https://community.splunk.com/t5/Splunk-Search/Error-to-search-data/m-p/160372#M45329 <P>Hi rajuljain19900526,</P> <P>assuming you installed the full Splunk version on both (not only the universal forwarder on your forwarding server2), then this will be the default behavior for Splunk on server2. If you want Splunk on server2 to locally index and forward the events to server1 read the docs <A href="http://docs.splunk.com/Documentation/Splunk/6.2.1/Forwarding/Routeandfilterdatad#Perform_selective_indexing_and_forwarding">http://docs.splunk.com/Documentation/Splunk/6.2.1/Forwarding/Routeandfilterdatad#Perform_selective_indexing_and_forwarding</A> </P> <PRE><CODE>Index all the data before forwarding it. To do this, just enable the indexAndForward attribute in outputs.conf. </CODE></PRE> <P>Or goto <CODE>Settings » Forwarding and receiving » Forwarding defaults</CODE> in the UI and select </P> <PRE><CODE>Store a local copy of forwarded events? </CODE></PRE> <P>Hope this helps ...</P> <P>cheers, MuS</P> Wed, 17 Dec 2014 12:24:55 GMT https://community.splunk.com/t5/Splunk-Search/Error-to-search-data/m-p/160372#M45329 MuS 2014-12-17T12:24:55Z