Inputs are all enabled but Search dashboard is showing 0 sources and 0 sourcetypes

[Nicholas_Key]

I am perplexed with what I'm experiencing right now.

I have all the file inputs enabled for monitor but I'm not seeing them at the Sources and Sourcetypes columns. I have also confirmed it at the Manager page that the inputs are enabled; and also the inputs.conf that the disabled=0

Any idea why this is happening?

[Simeon · Accepted solution]

Possible problems:

1. Are the inputs set to be indexed to a different index?
2. Might your role be restricted to only search one index?
3. Do the metrics log show that data is being read (or has been indexed)? If not, then those files are probably not being indexed for some other reason.
4. Does Splunk actually think it should be monitoring those files?

Enabling debugging may tell you more and you can also list the monitored files:

>./splunk list monitor

[Nicholas_Key]

my mistake ... apparently i totally forgotten that I configured forwarding & receiving (which the indexing is disabled by default a the forwarder)