Splunk App for Windows - Error on Check Data

[teak421]

Hi... I've installed SAW and everything is proceeding fine until I get to the CHECK DATA part of the setup. What happens is that when it does search checks it returns invalid...or, no data within 24 hours. I copied the search that they used which is just sourcetype="Perfmon*" | head 5 and it does indeed return nothing. BUT, if I do index=oswinperf sourcetype="Perfmon*" | head 5 it works. So, how do I change the search setting inside of the configuration wizard so I can start using SAW? Thanks in advance for your help.

[anmolpatel]

@teak421 have you enabled the input?
Have you configured the indexes?
Are you sending the logs to the Indexer(s)?

[teak421]

The problem turned out that reading the documentation I did the recommended general indexes...those indexes were not the same as the indexes in the documentation for the SAWI app. Since I am new, I didn't catch that until I read further. I wish the documentation (which is quite good) was a little clearer on this.

Thanks for your reply...