Deployment Architecture

Trouble with custom indexer

keekkenen
Engager

Hi, all
I created custom indexer with default parameters and for files/folder monitor define it indexer. After added files to folder and in indexes I see updated indexer info
alt text

But data summary is empty and in the search (*) results is empty too

alt text

What's wrong ?

The forwarder also sending data - it I see by changed index parameters, but it not usable.

if I delete indexer and set monitor without custom indexer - all work correctly.

Please, help me with it trouble.

Tags (1)
0 Karma

keekkenen
Engager

I got my mistake - I didn't add new index for using role - role can't access to index data

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...