Deployment Architecture

Trouble with custom indexer

keekkenen
Engager

Hi, all
I created custom indexer with default parameters and for files/folder monitor define it indexer. After added files to folder and in indexes I see updated indexer info
alt text

But data summary is empty and in the search (*) results is empty too

alt text

What's wrong ?

The forwarder also sending data - it I see by changed index parameters, but it not usable.

if I delete indexer and set monitor without custom indexer - all work correctly.

Please, help me with it trouble.

Tags (1)
0 Karma

keekkenen
Engager

I got my mistake - I didn't add new index for using role - role can't access to index data

0 Karma
Get Updates on the Splunk Community!

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...

Announcing the Migration of the Splunk Add-on for Microsoft Azure Inputs to ...

Announcing the Migration of the Splunk Add-on for Microsoft Azure Inputs to Officially Supported Splunk ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI! Discover how Splunk’s agentic AI ...