Data Not found on indexer cluster

[shashi12345678]

Using Splunk Enterprise trail license :

hi,

I have forwarded a file to indexer cluster by installing universal forwarder on host and deploying config files to UF using deployment server. but could find the data on cluster or search head, could someone help me to find out the issue from the below

Architecture Overview on GCP (Google Cloud Platform):

1 master node
1 search head
3 indexers
2 universal forwarders
1 deployment server

Server.conf on master node : path (opt/splunk/etc/system/local/

[clustering]
mode = master
replication_factor = 3
search_factor = 2

Deployment server configurations:

Created 2 apps under /opt/splunk/etc/deployment-apps/

UF_1
UF_2

configurations for app : UF_1
/opt/splunk/etc/deployment-apps/UF_1/default

Inputs.conf
[monitor://home/data/Phone_Numbers.csv]
disabled=false

outputs.conf
[tcpout]
defaultGroup = default-autolb-group
[tcpout:default-autolb-group]
disabled = false
server = x.x.x.x:9997,y.y.y.y:9997,z.z.z.z:9997

serverclass.conf on deployment server : path /opt/splunk/etc/system/local/

[serverClass:class_1:app:UF_1]
restartSplunkWeb = 0
restartSplunkd = 1
stateOnClient = enabled
[serverClass:class_1]
whitelist.0 = universalforwarder
[serverClass:class_2:app:UF_2]
restartSplunkWeb = 0
restartSplunkd = 1
stateOnClient = enabled
[serverClass:class_2]
whitelist.0 = universalforwarder-2

1.Universal forwarder configurations

inputs.conf
[monitor://home/data/Phone_Numbers.csv]
disabled=false

outputs.conf
[tcpout]
defaultGroup = default-autolb-group
[tcpout:default-autolb-group]
disabled = false
server = 103.104.86.126:9997,31.238.202.247:9997,31.202.197.21:9997

Verified on Indexer -1, couldn't find any file with timestamp created after data ingestion

/opt/splunk/var/lib/splunk/defaultdb/db
[root@indexer-1 db]# ls
CreationTime GlobalMetaData

verified on universal forwarder using command

./splunk list inputstatus

home/data/Phone_Numbers.csv
file position = 849
file size = 849
percent = 100.00
type = finished reading

[MuS]

Hi shashi12345678,

Have a look here https://docs.splunk.com/Documentation/Splunk/latest/Troubleshooting/Cantfinddata it contains a lot of advice what to check, but in general if you can't find your data it is most likely related to an timestamp issue where for example Splunk recognised the timestamp wrong and discarded the events because their were too old or too far from the future.

Hope this helps ...

cheers, MuS

[shashi12345678]

Hi MuS,

actually I was able ingest data into default index, but when im redirecting my data to a special index which I have created, the data is not ingesting.

[MuS]

What do you mean with redirecting ?
Did you create a props.conf and transforms.conf configuration to send these events into a special index? I also don't see any index = option in your posted inputs.conf ¯_(ツ)_/¯

cheers, MuS