Data Summary not reflecting on Dashboard

[pnikhade]

Hello Folks,

Setup 2 RHEL EC2 instances, with Splunk & UF configured on them. I added monitors as well as the Splunk server in UF but still the "sources" section shows waiting status.

Can someone please suggest what's wrong ?

[pnikhade]

Thanks for the reply. My Splunk setup is new so I am not fully aware which index data is going to. Perhaps it would be the main ?

If I run this below query, i do not see anything.

[livehybrid]

Hi @pnikhade 

Are you seeing any data when searching in your Splunk Instance? Do you know what indexes the data is supposed to be sending to? If you can see it with index=<yourIndex> then that will atleast confirm the data is arriving.

If you dont know which index it is going to then you can check the inputs.conf stanzas of your Universal Forwarder, or perhaps you can run the following to show you which sourcetypes you have in various indexes:

|metasearch index=* | stats values(sourcetype) by index

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing