Getting Data In

How to troubleshoot why data is not being indexed in Splunk 6.2?

templier
Communicator

Hello, i need help.

I have Splunk 6.2
It's sending data using a universal forwarder.
But on the server, I can only search by index=

And also if i go the Search & Reporting app, I see:
What to Search
Waiting for data...

And nothing... If I open Data Summary - it's empty

What do I do?
Thank you!

0 Karma
1 Solution

templier
Communicator

Once again understood myself.
The problem was in the rights of users.

View solution in original post

0 Karma

lindbergh_calde
Explorer

Hi

Just to Add to answer above. I too ran into the same issue. Splunk has done a few tweaks with the new version 6.2 and if you do not specify the index, the data cannot be searched successfully. hence to allow searching via sourcetype or etc.
Go to

1) Settings -> Access Control -> Roles (select the role applicable to you).
2) Scroll Down to "Indexes searched by default" and select the indexes you want to be included in your searches by default

This should work now.

Cheers

0 Karma

templier
Communicator

Hello, Cheers.

Thank you for your answer.
I will add - if you have more indexes or they will be added you can add the following settings:
1) Settings -> Access Control -> Roles (select the role applicable to you).
2) Scroll Down to "Indexes searched by default" and "Indexes" and select parameter "all non-internal indexes"

Sergey

templier
Communicator

Once again understood myself.
The problem was in the rights of users.

View solution in original post

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!