Deployment Architecture

Trouble with custom indexer

keekkenen
Engager

Hi, all
I created custom indexer with default parameters and for files/folder monitor define it indexer. After added files to folder and in indexes I see updated indexer info
alt text

But data summary is empty and in the search (*) results is empty too

alt text

What's wrong ?

The forwarder also sending data - it I see by changed index parameters, but it not usable.

if I delete indexer and set monitor without custom indexer - all work correctly.

Please, help me with it trouble.

Tags (1)
0 Karma

keekkenen
Engager

I got my mistake - I didn't add new index for using role - role can't access to index data

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...