Alerting

No Data in Search App

macleadg
New Member

I installed a Splunk search head on my Windows machine.  I installed a forwarder on a RHEL8 VM hosted by the same machine.  The forwarder monitors /var and /etc.  The systems can ping each other, and ports 9997 and 8089 are open.  I have restarted Splunk on both systems.  No errors occurred during installation or on any other operation, but no data appears on the search head.

Please help.

Labels (1)
0 Karma

thambisetty
Super Champion

What about permissions?

may be user which is running splunk forwarder doesn’t have read access to those files under var.

with root on rhel:

setfacl -m u:splunkuser:r /var/log/secure

restart splunk you should see ssh logs from rhel8.

————————————
If this helps, give a like below.
0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!