Data Ingest issues

[ChristianF]

Howdy Splunkers,

Working on my Splunk deployment and ran into a funky issue. I am ingesting Palo Alto FW and Meraki network device logs via syslog server. Rsyslog is set to write logs down to a file and the UF is set to monitor the directories.

No issues there, however I do run into an issue why I try to source type or set an index for these logs. I have edited the indexes.conf in the local folder on my cluster manager and pushed the required indexes to my indexers.  When I go to search for the logs on my search head I cannot find any data. However it works properly whenever i do not have sourcetyping and index destination in my inputs.conf.

Any idea as to why?

[Manojbh_splunk]

Are you monitoring the path where the logs are written in the UF.

can you share your inputs.conf ? this will help you check further.

[ChristianF · Accepted solution]

I actually ended up resolving the issue myself, I didn't have my indexes.conf file on my search head which didn't allow me to see the data on my cluster.

[PickleRick]

Lack of indexes.conf on SH results only in lack of auto-completion in the search edit window. You still can manually write which index you want to search and it works.

[PickleRick]

We need more info. Especially relevant configs.