Deployment Architecture

Trouble with custom indexer

keekkenen
Engager

Hi, all
I created custom indexer with default parameters and for files/folder monitor define it indexer. After added files to folder and in indexes I see updated indexer info
alt text

But data summary is empty and in the search (*) results is empty too

alt text

What's wrong ?

The forwarder also sending data - it I see by changed index parameters, but it not usable.

if I delete indexer and set monitor without custom indexer - all work correctly.

Please, help me with it trouble.

Tags (1)
0 Karma

keekkenen
Engager

I got my mistake - I didn't add new index for using role - role can't access to index data

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...