Archive
Highlighted

Not indexing

New Member

We have just set up Distributed search with 2 indexers and one search node. Our data source is a folder with log files. The splunkd.log show many lines with the following
WatchFile - using folow tail will begin reading EOF for F:\splunk\index01....
But we get No results when searching. Are we being impatient?

Tags (2)
0 Karma
Highlighted

Re: Not indexing

Ultra Champion

it can be :

  • the forwarder has a default thruput limit of 256KBps, and is queuing a large file
  • the events have a misconfigured sourcetype, causing the timestamp/timezone to be misinterpreted, and the events to be in the future (or centuries in the past). Verify with a real-time "alltime" search to see the events that are currently received.

you also can check in your license logs to see is the file has been indexed (index=internal source=*licenseusage.log* "myfile" )

Highlighted

Re: Not indexing

New Member

Thanks for your help

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.