Data is not making to indexer

[ssankeneni]

The Data forwarded by universal forwarder is not making to the indexer. There is no clue on splunkd.log file even. It shows that the forwarder has made a connection to indexer. Any help would be appreciated.

[lguinn2 · Accepted solution]

First, you must create the index before you direct any inputs to the index. Go to Manager>>Indexes and create the testindex there.

Second, searches only include a default set of indexes, based on your role. When you create a new index (such as textindex), you need to add it to any roles where you wish for the new index to be searched by default. You also must include the new index in any roles that will be allowed to search it explicitly. Go to Manager>>Access Controls to edit these settings.

If you did create the testindex, try this search to see if there is anything in it:

index=testindex

You can also look at the testindex in Manager>>Indexes, which will show how many events it contains.

HTH

[ssankeneni]

Thanks for the answer.. but my problem was the indexer is forwarding to another server. I removed it and it started working back. Thank you for your help.

[ssankeneni]

I'm unable to index the data on the same splunk instance even. My inputs.conf file on the same instance. I can't see any testindex being created.
[default]
host = vm10177
[monitor:///home/ssanke/SplunkTests/logs/DistSearch]
index = testindex

[Ayn]

Please provide much more details on your setup - inputs, outputs, etc etc. It's impossible to help you without having any details.