First, you must create the index before you direct any inputs to the index. Go to Manager>>Indexes and create the testindex
there.
Second, searches only include a default set of indexes, based on your role. When you create a new index (such as textindex
), you need to add it to any roles where you wish for the new index to be searched by default. You also must include the new index in any roles that will be allowed to search it explicitly. Go to Manager>>Access Controls to edit these settings.
If you did create the testindex
, try this search to see if there is anything in it:
index=testindex
You can also look at the testindex
in Manager>>Indexes, which will show how many events it contains.
HTH
First, you must create the index before you direct any inputs to the index. Go to Manager>>Indexes and create the testindex
there.
Second, searches only include a default set of indexes, based on your role. When you create a new index (such as textindex
), you need to add it to any roles where you wish for the new index to be searched by default. You also must include the new index in any roles that will be allowed to search it explicitly. Go to Manager>>Access Controls to edit these settings.
If you did create the testindex
, try this search to see if there is anything in it:
index=testindex
You can also look at the testindex
in Manager>>Indexes, which will show how many events it contains.
HTH
Thanks for the answer.. but my problem was the indexer is forwarding to another server. I removed it and it started working back. Thank you for your help.
I'm unable to index the data on the same splunk instance even. My inputs.conf file on the same instance. I can't see any testindex being created.
[default]
host = vm10177
[monitor:///home/ssanke/SplunkTests/logs/DistSearch]
index = testindex
Please provide much more details on your setup - inputs, outputs, etc etc. It's impossible to help you without having any details.