Getting Data In

Data going to main even after set to different index

johnlzy0408
Loves-to-Learn Lots

Hi all, 

 

I have install splunk forwarder in 1 centos device, sending to indexer. 

From the search head, i can see data from this host but the the index is put as Main. 

On the app, we have already specify to another index and we verified that the index is created. 

1.PNG

2.PNG

Anybody know what am i missing? Already restart splunk services for both host and searchhead. 

 

Labels (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Double-check the query and settings.  The btool output shown is for source /var/log/messages, but the query is showing source=/var/log/cron.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

johnlzy0408
Loves-to-Learn Lots

Yea i know, I am just showing an example. 

This is the actual settings. 

 

3.PNG

 

This is the settings in the inputs.conf. Strangely, this is set to disabled but we are receiving from this source. 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

If you're receiving data for a disabled input then the inputs.conf either has not been loaded (restart the forwarder) or is overridden by another inputs.conf file (btool should show that).  The same goes for data being sent to the wrong index.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

johnlzy0408
Loves-to-Learn Lots

I mean for the /var/log/cron. And strangely, all my /var/logs/messages path are also not sending since this morning. i do not know what i did 

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!