Deployment Architecture
Highlighted

Data Not found on indexer cluster

Using Splunk Enterprise trail license :

hi,

I have forwarded a file to indexer cluster by installing universal forwarder on host and deploying config files to UF using deployment server. but could find the data on cluster or search head, could someone help me to find out the issue from the below

Architecture Overview on GCP (Google Cloud Platform):

1 master node
1 search head
3 indexers
2 universal forwarders
1 deployment server

Server.conf on master node : path (opt/splunk/etc/system/local/

[clustering]
mode = master
replicationfactor = 3
search
factor = 2

Deployment server configurations:

Created 2 apps under /opt/splunk/etc/deployment-apps/

UF1
UF
2

configurations for app : UF1
/opt/splunk/etc/deployment-apps/UF
1/default

Inputs.conf
[monitor://home/data/Phone_Numbers.csv]
disabled=false

outputs.conf
[tcpout]
defaultGroup = default-autolb-group
[tcpout:default-autolb-group]
disabled = false
server = x.x.x.x:9997,y.y.y.y:9997,z.z.z.z:9997

serverclass.conf on deployment server : path /opt/splunk/etc/system/local/

[serverClass:class1:app:UF1]
restartSplunkWeb = 0
restartSplunkd = 1
stateOnClient = enabled
[serverClass:class1]
whitelist.0 = universalforwarder
[serverClass:class
2:app:UF2]
restartSplunkWeb = 0
restartSplunkd = 1
stateOnClient = enabled
[serverClass:class
2]
whitelist.0 = universalforwarder-2

1.Universal forwarder configurations

inputs.conf
[monitor://home/data/Phone_Numbers.csv]
disabled=false

outputs.conf
[tcpout]
defaultGroup = default-autolb-group
[tcpout:default-autolb-group]
disabled = false
server = 103.104.86.126:9997,31.238.202.247:9997,31.202.197.21:9997

Verified on Indexer -1, couldn't find any file with timestamp created after data ingestion

/opt/splunk/var/lib/splunk/defaultdb/db
[root@indexer-1 db]# ls
CreationTime GlobalMetaData

verified on universal forwarder using command

./splunk list inputstatus

home/data/Phone_Numbers.csv
file position = 849
file size = 849
percent = 100.00
type = finished reading

0 Karma
Highlighted

Re: Data Not found on indexer cluster

SplunkTrust
SplunkTrust

Hi shashi12345678,

Have a look here https://docs.splunk.com/Documentation/Splunk/latest/Troubleshooting/Cantfinddata it contains a lot of advice what to check, but in general if you can't find your data it is most likely related to an timestamp issue where for example Splunk recognised the timestamp wrong and discarded the events because their were too old or too far from the future.

Hope this helps ...

cheers, MuS

0 Karma
Highlighted

Re: Data Not found on indexer cluster

Hi MuS,

actually I was able ingest data into default index, but when im redirecting my data to a special index which I have created, the data is not ingesting.

0 Karma
Highlighted

Re: Data Not found on indexer cluster

SplunkTrust
SplunkTrust

What do you mean with redirecting ?
Did you create a props.conf and transforms.conf configuration to send these events into a special index? I also don't see any index = option in your posted inputs.conf ¯_(ツ)_/¯

cheers, MuS

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.