How do I get the *nix app on the indexer to include the forwarded *nix data.

[labrat]

I have the unix machines forwarding *nix recordes. I can use search to view the records.

How do get the *nix application on the indexer to include those records. I all I see is the local *nix records.

[LCM · Accepted solution]

Is your forwarder & receiver properly working?

If not you may check these out first:

• http://www.splunk.com/base/Documentation/4.1.7/admin/AboutForwardingAndReceiving
• http://www.splunk.com/base/Documentation/4.1.7/admin/Enableforwardingandreceiving

[labrat]

I did spend some time looking through this documentation. I may have misunderstood something.

I am using the lightweight forwarder, is that OK.

[LCM]

Yes, it works with a lightweight forwarder!

Check the connection on forwarder:

* grep "Connected to /opt/splunk/var/log/splunk/splunkd.log

Check the connection on the indexer:

* grep "Connection accepted from /opt/splunk/var/log/splunk/splunkd.log