Getting Data In

Data is not making to indexer

ssankeneni
Communicator

The Data forwarded by universal forwarder is not making to the indexer. There is no clue on splunkd.log file even. It shows that the forwarder has made a connection to indexer. Any help would be appreciated.

Tags (3)
0 Karma
1 Solution

lguinn2
Legend

First, you must create the index before you direct any inputs to the index. Go to Manager>>Indexes and create the testindex there.

Second, searches only include a default set of indexes, based on your role. When you create a new index (such as textindex), you need to add it to any roles where you wish for the new index to be searched by default. You also must include the new index in any roles that will be allowed to search it explicitly. Go to Manager>>Access Controls to edit these settings.

If you did create the testindex, try this search to see if there is anything in it:

index=testindex

You can also look at the testindex in Manager>>Indexes, which will show how many events it contains.

HTH

View solution in original post

lguinn2
Legend

First, you must create the index before you direct any inputs to the index. Go to Manager>>Indexes and create the testindex there.

Second, searches only include a default set of indexes, based on your role. When you create a new index (such as textindex), you need to add it to any roles where you wish for the new index to be searched by default. You also must include the new index in any roles that will be allowed to search it explicitly. Go to Manager>>Access Controls to edit these settings.

If you did create the testindex, try this search to see if there is anything in it:

index=testindex

You can also look at the testindex in Manager>>Indexes, which will show how many events it contains.

HTH

ssankeneni
Communicator

Thanks for the answer.. but my problem was the indexer is forwarding to another server. I removed it and it started working back. Thank you for your help.

0 Karma

ssankeneni
Communicator

I'm unable to index the data on the same splunk instance even. My inputs.conf file on the same instance. I can't see any testindex being created.
[default]
host = vm10177
[monitor:///home/ssanke/SplunkTests/logs/DistSearch]
index = testindex

0 Karma

Ayn
Legend

Please provide much more details on your setup - inputs, outputs, etc etc. It's impossible to help you without having any details.

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...