Getting Data In

Not able to search index=_internal from searchead

eburnett
Engager

I'm trying to do a search against index=_internal but I do not see this index on my searchhead. 

I do see it when I do a search from the indexers.

Any suggestions where I should look first to fix this?

Labels (3)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @eburnett,

at first sight the problem seems to be the one indicated by @s2_splunk.

In addition, you could check if you're sending internal logs from all your Splunk servers to the Indexer (this is a best practice for distributed architectures).

You can do this forwarding logs from all your Splunk Servers (also Search Heads) to the Indexer [Settings -- Forwardring and Receiving -- Forward].

Ciao.

Giuseppe

0 Karma

s2_splunk
Splunk Employee
Splunk Employee

Sounds like your user role doesn't have permission to look at internal indices? 

0 Karma

eburnett
Engager

So I tried to do this search with admin account and you are correct I can see  results from this search then.  index=_internal*

So Do I need to change permissions somewhere to see these with a user account? 

0 Karma

s2_splunk
Splunk Employee
Splunk Employee

Yes, you will need to provide access to indices as needed by role (not user). Please review docs how to go about it. 

Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.