Getting Data In

Inputs are all enabled but Search dashboard is showing 0 sources and 0 sourcetypes

Nicholas_Key
Splunk Employee
Splunk Employee

I am perplexed with what I'm experiencing right now.

I have all the file inputs enabled for monitor but I'm not seeing them at the Sources and Sourcetypes columns. I have also confirmed it at the Manager page that the inputs are enabled; and also the inputs.conf that the disabled=0

Any idea why this is happening?

Tags (1)
1 Solution

Simeon
Splunk Employee
Splunk Employee

Possible problems:

  1. Are the inputs set to be indexed to a different index?
  2. Might your role be restricted to only search one index?
  3. Do the metrics log show that data is being read (or has been indexed)? If not, then those files are probably not being indexed for some other reason.
  4. Does Splunk actually think it should be monitoring those files?

Enabling debugging may tell you more and you can also list the monitored files:

>./splunk list monitor

View solution in original post

Simeon
Splunk Employee
Splunk Employee

Possible problems:

  1. Are the inputs set to be indexed to a different index?
  2. Might your role be restricted to only search one index?
  3. Do the metrics log show that data is being read (or has been indexed)? If not, then those files are probably not being indexed for some other reason.
  4. Does Splunk actually think it should be monitoring those files?

Enabling debugging may tell you more and you can also list the monitored files:

>./splunk list monitor

Nicholas_Key
Splunk Employee
Splunk Employee

my mistake ... apparently i totally forgotten that I configured forwarding & receiving (which the indexing is disabled by default a the forwarder)

0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...