Getting Data In

Inputs are all enabled but Search dashboard is showing 0 sources and 0 sourcetypes

Nicholas_Key
Splunk Employee
Splunk Employee

I am perplexed with what I'm experiencing right now.

I have all the file inputs enabled for monitor but I'm not seeing them at the Sources and Sourcetypes columns. I have also confirmed it at the Manager page that the inputs are enabled; and also the inputs.conf that the disabled=0

Any idea why this is happening?

Tags (1)
1 Solution

Simeon
Splunk Employee
Splunk Employee

Possible problems:

  1. Are the inputs set to be indexed to a different index?
  2. Might your role be restricted to only search one index?
  3. Do the metrics log show that data is being read (or has been indexed)? If not, then those files are probably not being indexed for some other reason.
  4. Does Splunk actually think it should be monitoring those files?

Enabling debugging may tell you more and you can also list the monitored files:

>./splunk list monitor

View solution in original post

Simeon
Splunk Employee
Splunk Employee

Possible problems:

  1. Are the inputs set to be indexed to a different index?
  2. Might your role be restricted to only search one index?
  3. Do the metrics log show that data is being read (or has been indexed)? If not, then those files are probably not being indexed for some other reason.
  4. Does Splunk actually think it should be monitoring those files?

Enabling debugging may tell you more and you can also list the monitored files:

>./splunk list monitor

Nicholas_Key
Splunk Employee
Splunk Employee

my mistake ... apparently i totally forgotten that I configured forwarding & receiving (which the indexing is disabled by default a the forwarder)

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...