Deployment Architecture

Data Not found on indexer cluster

shashi12345678
Engager

Using Splunk Enterprise trail license :

hi,

I have forwarded a file to indexer cluster by installing universal forwarder on host and deploying config files to UF using deployment server. but could find the data on cluster or search head, could someone help me to find out the issue from the below

Architecture Overview on GCP (Google Cloud Platform):

1 master node
1 search head
3 indexers
2 universal forwarders
1 deployment server

Server.conf on master node : path (opt/splunk/etc/system/local/

[clustering]
mode = master
replication_factor = 3
search_factor = 2

Deployment server configurations:

Created 2 apps under /opt/splunk/etc/deployment-apps/

UF_1
UF_2

configurations for app : UF_1
/opt/splunk/etc/deployment-apps/UF_1/default

Inputs.conf
[monitor://home/data/Phone_Numbers.csv]
disabled=false

outputs.conf
[tcpout]
defaultGroup = default-autolb-group
[tcpout:default-autolb-group]
disabled = false
server = x.x.x.x:9997,y.y.y.y:9997,z.z.z.z:9997

serverclass.conf on deployment server : path /opt/splunk/etc/system/local/

[serverClass:class_1:app:UF_1]
restartSplunkWeb = 0
restartSplunkd = 1
stateOnClient = enabled
[serverClass:class_1]
whitelist.0 = universalforwarder
[serverClass:class_2:app:UF_2]
restartSplunkWeb = 0
restartSplunkd = 1
stateOnClient = enabled
[serverClass:class_2]
whitelist.0 = universalforwarder-2

1.Universal forwarder configurations

inputs.conf
[monitor://home/data/Phone_Numbers.csv]
disabled=false

outputs.conf
[tcpout]
defaultGroup = default-autolb-group
[tcpout:default-autolb-group]
disabled = false
server = 103.104.86.126:9997,31.238.202.247:9997,31.202.197.21:9997

Verified on Indexer -1, couldn't find any file with timestamp created after data ingestion

/opt/splunk/var/lib/splunk/defaultdb/db
[root@indexer-1 db]# ls
CreationTime GlobalMetaData

verified on universal forwarder using command

./splunk list inputstatus

home/data/Phone_Numbers.csv
file position = 849
file size = 849
percent = 100.00
type = finished reading

0 Karma

MuS
SplunkTrust
SplunkTrust

Hi shashi12345678,

Have a look here https://docs.splunk.com/Documentation/Splunk/latest/Troubleshooting/Cantfinddata it contains a lot of advice what to check, but in general if you can't find your data it is most likely related to an timestamp issue where for example Splunk recognised the timestamp wrong and discarded the events because their were too old or too far from the future.

Hope this helps ...

cheers, MuS

0 Karma

shashi12345678
Engager

Hi MuS,

actually I was able ingest data into default index, but when im redirecting my data to a special index which I have created, the data is not ingesting.

0 Karma

MuS
SplunkTrust
SplunkTrust

What do you mean with redirecting ?
Did you create a props.conf and transforms.conf configuration to send these events into a special index? I also don't see any index = option in your posted inputs.conf ¯_(ツ)_/¯

cheers, MuS

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...