Deployment Architecture

Data Not found on indexer cluster

shashi12345678
Engager

Using Splunk Enterprise trail license :

hi,

I have forwarded a file to indexer cluster by installing universal forwarder on host and deploying config files to UF using deployment server. but could find the data on cluster or search head, could someone help me to find out the issue from the below

Architecture Overview on GCP (Google Cloud Platform):

1 master node
1 search head
3 indexers
2 universal forwarders
1 deployment server

Server.conf on master node : path (opt/splunk/etc/system/local/

[clustering]
mode = master
replication_factor = 3
search_factor = 2

Deployment server configurations:

Created 2 apps under /opt/splunk/etc/deployment-apps/

UF_1
UF_2

configurations for app : UF_1
/opt/splunk/etc/deployment-apps/UF_1/default

Inputs.conf
[monitor://home/data/Phone_Numbers.csv]
disabled=false

outputs.conf
[tcpout]
defaultGroup = default-autolb-group
[tcpout:default-autolb-group]
disabled = false
server = x.x.x.x:9997,y.y.y.y:9997,z.z.z.z:9997

serverclass.conf on deployment server : path /opt/splunk/etc/system/local/

[serverClass:class_1:app:UF_1]
restartSplunkWeb = 0
restartSplunkd = 1
stateOnClient = enabled
[serverClass:class_1]
whitelist.0 = universalforwarder
[serverClass:class_2:app:UF_2]
restartSplunkWeb = 0
restartSplunkd = 1
stateOnClient = enabled
[serverClass:class_2]
whitelist.0 = universalforwarder-2

1.Universal forwarder configurations

inputs.conf
[monitor://home/data/Phone_Numbers.csv]
disabled=false

outputs.conf
[tcpout]
defaultGroup = default-autolb-group
[tcpout:default-autolb-group]
disabled = false
server = 103.104.86.126:9997,31.238.202.247:9997,31.202.197.21:9997

Verified on Indexer -1, couldn't find any file with timestamp created after data ingestion

/opt/splunk/var/lib/splunk/defaultdb/db
[root@indexer-1 db]# ls
CreationTime GlobalMetaData

verified on universal forwarder using command

./splunk list inputstatus

home/data/Phone_Numbers.csv
file position = 849
file size = 849
percent = 100.00
type = finished reading

0 Karma

MuS
SplunkTrust
SplunkTrust

Hi shashi12345678,

Have a look here https://docs.splunk.com/Documentation/Splunk/latest/Troubleshooting/Cantfinddata it contains a lot of advice what to check, but in general if you can't find your data it is most likely related to an timestamp issue where for example Splunk recognised the timestamp wrong and discarded the events because their were too old or too far from the future.

Hope this helps ...

cheers, MuS

0 Karma

shashi12345678
Engager

Hi MuS,

actually I was able ingest data into default index, but when im redirecting my data to a special index which I have created, the data is not ingesting.

0 Karma

MuS
SplunkTrust
SplunkTrust

What do you mean with redirecting ?
Did you create a props.conf and transforms.conf configuration to send these events into a special index? I also don't see any index = option in your posted inputs.conf ¯_(ツ)_/¯

cheers, MuS

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk Life | Splunk is Officially Part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint. Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...