After configuring Splunk Add-on Unix and Linux using default settings, why is it not fetching data from the os index?

[somchatt78]

I'm in the process of setting up the Splunk App for Unix and Linux and the Splunk Add-on for Unix and Linux.

I've installed and configured the App via Splunk Web using default settings. I've installed the Add-on on one of my Linux boxes and enabled all of the default inputs using default settings. But I don't have data flowing into the "os" index.

But when I run other queries on other log files , I am getting results (the sourcetype has been defined in /opt/splunkforwarder/etc/apps/search/local/inputs.conf)

[monitor:///var/log/sudo.log]
disabled = false
index = main
sourcetype = sudolog

But the problem is I am unable get data populated for os index.
Can anyone help?

[dmaislin_splunk]

Are you running Splunk as root? Does the forwarder have access to that log? You can check your logs for errors in your /opt/splunkforwarder/var/log/splunk/splunkd.log as well.

[somchatt78]

Hi .. yes I am running both splunk and forwarder as root on two different machines. Forwarder have access to all logs. I am able to index other logs, but not able to index the OS ....
is there anything else that I need to do ?