Getting Data In

Data flow/input question - see data being received but does not appear indexed

mattshwink1
Loves-to-Learn

So I see data coming in:

04-13-2021 17:32:25.470 -0400 INFO StatusMgr - destPort=9997, eventType=connect_done, group=tcpin_connections, sourceHost=*.*.153.70, sourceIp=*.*.153.70, sourcePort=39820, statusee=TcpInputProcessor
 
But I can't find where this data is going.  I have the source info and have searched all indexes on the above IPs as well as keywords/fields from the source but can't find it.  Where does it go next?  How can I tell if the indexer is generating errors or rejecting it?

This data is being sent directly to my indexer cluster from a remote CRIBL source.  The data is text (comma delimited).
 
Where does the data go next?
 
Also, if I want to configure the IP do I configure a source in the cluster master under master apps and push it out:
/master-apps/cribl/local/inputs.conf
[tcp://*.*.153.70:9997]
index=cribl
 
or do I have to do this in /system/local/inputs.conf on each indexer? 
 
or do I have to forward to a HF first.

Thanks!
 
Labels (1)
0 Karma
Get Updates on the Splunk Community!

Enhance Your Splunk App Development: New Tools & Support

UCC FrameworkAdd-on Builder has been around for quite some time. It helps build Splunk apps faster, but it ...

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...