Data is not being indexed?

[abhi04]

I can't see my data being indexed. I have checked the outputs and inputs .confirm and the correct server and ports is mentioned.
What all can be checked apart from this to triage.

[skoelpin]

You should check what the logs say.

*nix
/opt/splunk/var/log/splunk/splunkd.log

Windows
C:/Program Files/Splunk/var/log/splunk/splunkd.log

[adonio · Accepted solution]

hello there,

start with this link:
https://docs.splunk.com/Documentation/Splunk/7.0.1/Troubleshooting/Cantfinddata
please share what are your findings and also if you still cant solve it

hope it helps

[micahkemp]

Are you running a single instance, or is your indexer separate from your search head? Is the data you're attempting to index on your indexer, search head, or a separate forwarder?

[abhi04]

A separate indexer ,search head and forwarder.

[micahkemp]

And where is the data you're trying to index?

[abhi04]

In an application server

[micahkemp]

Is that application server running a Splunk forwarder? If not, what method are you method are you intending to use to get its data?