Getting Data In

How to troubleshoot why data is not being indexed in Splunk 6.2?

templier
Communicator

Hello, i need help.

I have Splunk 6.2
It's sending data using a universal forwarder.
But on the server, I can only search by index=

And also if i go the Search & Reporting app, I see:
What to Search
Waiting for data...

And nothing... If I open Data Summary - it's empty

What do I do?
Thank you!

0 Karma
1 Solution

templier
Communicator

Once again understood myself.
The problem was in the rights of users.

View solution in original post

0 Karma

lindbergh_calde
Explorer

Hi

Just to Add to answer above. I too ran into the same issue. Splunk has done a few tweaks with the new version 6.2 and if you do not specify the index, the data cannot be searched successfully. hence to allow searching via sourcetype or etc.
Go to

1) Settings -> Access Control -> Roles (select the role applicable to you).
2) Scroll Down to "Indexes searched by default" and select the indexes you want to be included in your searches by default

This should work now.

Cheers

0 Karma

templier
Communicator

Hello, Cheers.

Thank you for your answer.
I will add - if you have more indexes or they will be added you can add the following settings:
1) Settings -> Access Control -> Roles (select the role applicable to you).
2) Scroll Down to "Indexes searched by default" and "Indexes" and select parameter "all non-internal indexes"

Sergey

templier
Communicator

Once again understood myself.
The problem was in the rights of users.

0 Karma
Get Updates on the Splunk Community!

Welcome to the Future of Data Search & Exploration

You have more data coming at you than ever before. Over the next five years, the total amount of digital data ...

What’s new on Splunk Lantern in August

This month’s Splunk Lantern update gives you the low-down on all of the articles we’ve published over the past ...

This Week's Community Digest - Splunk Community Happenings [8.3.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...