No port_scan data

[richgalloway]

We're running Splunk for Asset Discovery 6.0 under Splunk 6 on an Ubuntu system. The app has been running for a week, but we have no data in the asset_discovery index. There are several input scripts defined and enabled, including '$SPLUNK_HOME/etc/apps/asset_discovery/bin/nmap.sh -A -O 192.168.100.0/24'. If I run this command manually, I see data for all of the hosts in that subnet. However, a search of 'index=asset_discovery' returns no events. nmap is owned by root. I assume it is running as root also since all of Splunk does so.

I see nothing in splunkd.log other than "INFO ExecProcessor - New scheduled exec process:
/opt/splunk/etc/apps/asset_discovery/bin/nmap.sh -A -O 192.168.100.0/24."

Where is my port_scan data going?

[richgalloway]

1800 seconds

[lukejadamec]

What is the interval in the asset_discovery inputs.conf for that script?

[richgalloway]

I've searched 'sourcetype=port_scan' and 'source=nmap' without an index specified and get no results.

Index manager says asset_discovery has zero events.

[lukejadamec]

Did you check the default index?
You can also check Manager>Index to see if the asset_discovery index was created and if it contains any data.