Deployment Architecture

Data Not found on indexer cluster

shashi12345678
Engager

Using Splunk Enterprise trail license :

hi,

I have forwarded a file to indexer cluster by installing universal forwarder on host and deploying config files to UF using deployment server. but could find the data on cluster or search head, could someone help me to find out the issue from the below

Architecture Overview on GCP (Google Cloud Platform):

1 master node
1 search head
3 indexers
2 universal forwarders
1 deployment server

Server.conf on master node : path (opt/splunk/etc/system/local/

[clustering]
mode = master
replication_factor = 3
search_factor = 2

Deployment server configurations:

Created 2 apps under /opt/splunk/etc/deployment-apps/

UF_1
UF_2

configurations for app : UF_1
/opt/splunk/etc/deployment-apps/UF_1/default

Inputs.conf
[monitor://home/data/Phone_Numbers.csv]
disabled=false

outputs.conf
[tcpout]
defaultGroup = default-autolb-group
[tcpout:default-autolb-group]
disabled = false
server = x.x.x.x:9997,y.y.y.y:9997,z.z.z.z:9997

serverclass.conf on deployment server : path /opt/splunk/etc/system/local/

[serverClass:class_1:app:UF_1]
restartSplunkWeb = 0
restartSplunkd = 1
stateOnClient = enabled
[serverClass:class_1]
whitelist.0 = universalforwarder
[serverClass:class_2:app:UF_2]
restartSplunkWeb = 0
restartSplunkd = 1
stateOnClient = enabled
[serverClass:class_2]
whitelist.0 = universalforwarder-2

1.Universal forwarder configurations

inputs.conf
[monitor://home/data/Phone_Numbers.csv]
disabled=false

outputs.conf
[tcpout]
defaultGroup = default-autolb-group
[tcpout:default-autolb-group]
disabled = false
server = 103.104.86.126:9997,31.238.202.247:9997,31.202.197.21:9997

Verified on Indexer -1, couldn't find any file with timestamp created after data ingestion

/opt/splunk/var/lib/splunk/defaultdb/db
[root@indexer-1 db]# ls
CreationTime GlobalMetaData

verified on universal forwarder using command

./splunk list inputstatus

home/data/Phone_Numbers.csv
file position = 849
file size = 849
percent = 100.00
type = finished reading

0 Karma

MuS
SplunkTrust
SplunkTrust

Hi shashi12345678,

Have a look here https://docs.splunk.com/Documentation/Splunk/latest/Troubleshooting/Cantfinddata it contains a lot of advice what to check, but in general if you can't find your data it is most likely related to an timestamp issue where for example Splunk recognised the timestamp wrong and discarded the events because their were too old or too far from the future.

Hope this helps ...

cheers, MuS

0 Karma

shashi12345678
Engager

Hi MuS,

actually I was able ingest data into default index, but when im redirecting my data to a special index which I have created, the data is not ingesting.

0 Karma

MuS
SplunkTrust
SplunkTrust

What do you mean with redirecting ?
Did you create a props.conf and transforms.conf configuration to send these events into a special index? I also don't see any index = option in your posted inputs.conf ¯_(ツ)_/¯

cheers, MuS

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...