Index created on indexer not reflecting on search head or neither on deployment server?

[shanmugavelv]

Hi,
deployed a medium solution with 1 search head , 1 indexer and 1 (Deployment server(DS) + License master).
- Deployed an UF configs from Deployment server and created a new index via DS, but the index is not reflecting on indexer or SH.
- Created new index on indexer but not reflecting on SH or DS?
Can any one please clarify where to create new index in this type of medium deployment? and why it is not reflecting across other splunk instances?
thanks..

[martin_mueller]

Create an index on the indexer via indexes.conf. Then that index can receive data from forwarders, and be searched by search heads.
Tell forwarders to send data to that index via inputs.conf, deployed from your deployment server.
Search the data from your search head by specifying index=that_index in the search bar. Depending on your authorization configuration you may need to allow the role to search the index; by default all roles can search all non-internal indexes.

[martin_mueller]

Not seeing an index you created on the indexer on other systems (DS, SH) is expected and normal. Neither search head nor deployment server are supposed to have indexes, that's what indexers are for.

If searching for that index doesn't return events then there are several options:

• Is the indexer getting data? Since you've seem to have the UI on the indexer still enabled, see Settings -> Indexes to check if that index shows >0 events
• Is the SH connected to the indexer? Check on the SH, Settings -> Distributed Search -> Search Peers
• Is your user authorized to search the index? Usually fine if you're using the default roles
• Are you searching the index? Make sure your search is index=that_index
• Are you searching a time range matching your data? When in doubt, use All Time until you found something

[shanmugavelv]

Hi Martin,
Thanks for your reply. Actually I did the same, like I created an index via Indexer web/GUI and configured the UF from DS. Searched via SH using the index created, but dont see any result. Also I dont see the index created on the indexer in the SH index list as well not listing on DS index list.
Quest 1 - When we create index via INDEXER GUI/WEB does the same available in SH & DS?

And I tried inputing the data from DS via DATA INPUT option by mentioning the file path and created new index as the index created on indexer not listing. Not sure what's the issue here?