Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Dashboards & Visualizations
- :
- indexes not appear in cluster dashboard
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The indexes will not show up until they receive some data. Are you sending data to the indexes?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
after i "splunk restarted" them all, twice.
they showed up....
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
The indexes will not show up until they receive some data. Are you sending data to the indexes?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
|metadata type=sourcetypes index=idx-dn:
firstTime lastTime recentTime sourcetype totalCount type
1 1336071194 1342402517 1371955561 DNlog 1079499 sourcetypes
there are events in that index
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You said that you are receiving events. Look at the events in your search head and verify the index of the events.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
sorry i dont quite understand you. the index name is "idx-dn"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
What is the index of the events that you are receiving?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
inputs.conf and outputs.conf on FORWARDER:
[monitor:///DATA/DNlog/DN.log.*]
sourcetype = DNlog
index = IDX-DN
host = LogDB
disabled = false
[tcpout]
defaultGroup = Peer_Group
maxQueueSize = 500MB
[tcpout:Peer_Group]
autoLB = true
autoLBFrequency = 1
useACK = true
server = 172.16.40.98:9997, 172.16.40.99:9997, ......
indexes.conf on PEER-NODEs:
[IDX-DN]
repFactor = auto
coldPath = $SPLUNK_DB/idx-dn/colddb
homePath = $SPLUNK_DB/idx-dn/db
maxDataSize = auto_high_volume
thawedPath = $SPLUNK_DB/idx-dn/thaweddb
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
What is the value of index for the events that you are receiving? Could it be the default index? If so, you need to specify the index in the inputs.cont of your forwarder.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
yes， i did，i can see data on searchhead
Community Content Calendar, September edition
Splunkbase Unveils New App Listing Management Public Preview
Leveraging Automated Threat Analysis Across the Splunk Ecosystem
