Getting Data In

Receiver not receiving newly added index and data from sender!

Dark_Ichigo
Builder

I am currently successfully forwarding data of a created index from a sender to a receiver, the issue is I have created a new index with data inputs at the sender and I have configured all the correct inputs indexes confs and restarted both splunk servers and forwarders, The other index is coming through just fine, but the newly added one will not even budge through, I have spent the last 7 hours debugging and searching through the splunk logs for conf bugs or connection issues or even firewall problems which I doubted but checked anyway, in other words if the first index is working then there aren't any forwarder issues.

I cant think of anywhere else to check or debug any more, Any ideas?

0 Karma
1 Solution

Dark_Ichigo
Builder

I managed to fix the issue, but I have no idea how I did it, it just worked, must've been a typo somewhere.

View solution in original post

0 Karma

Dark_Ichigo
Builder

I think the issue was that one of the Data Inputs had a "/*" at the end in inputs.conf which was confusing it, removing this I assume was the reason for it to finally work.

0 Karma

MarioM
Motivator

can you paste your inputs.conf from forwarder and indexes.conf from indexer?
As well did you see anything in indexer splunkd.log and forwarder splunkd.log?

0 Karma

Dark_Ichigo
Builder

I managed to fix the issue, but I have no idea how I did it, it just worked, must've been a typo somewhere.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Value Insights: Now Generally Available in the CMC

Organizations are under pressure to move faster, control cost, expand AI adoption, and prove value with more ...

What’s New in Splunk AI: Volume 02

Welcome to the second edition of “What’s New in Splunk AI” where we look at the latest and greatest updates, ...

Splunk App Dev Quarterly Roundup: AI, Agents, and Innovation!

Another quarter, another wave of innovation. From complex integrations to pushing the limits ...