Getting Data In

Unversal Forwarder (win/*nix 9.1.1) with specific Index does not show up in Data summary anymore

benesch
Observer

Hi all,

I successfully forward data from Windows using the command

msiexec.exe /i splunkuniversalforwarder_x86.msi RECEIVING_INDEXER="indexer1:9997" WINEVENTLOG_SEC_ENABLE=1 WINEVENTLOG_SYS_ENABLE=1 AGREETOLICENSE=Yes /quiet

from Install a Windows universal forwarder .

The same for Linux with the command

./splunk add monitor /var/log

from Configure the universal forwarder using configuration files .

Both works fine and I can see the hosts in the Data Summary as visible in the following figure.

Data SummaryData Summary

If I instead set up the input in the local "inputs.conf" file after basic installation like

[perfmon://LocalPhysicalDisk]
interval = 10
object = PhysicalDisk
counters = Disk Bytes/sec; % Disk Read Time; % Disk Write Time; % Disk Time
instances = *
disabled = 0
index = winfwtestinger

for example and assign a specific index, I can see that data is ingested if I search for the specific index but they will not appear in the Data Summary. I would be very happy about any suggestion what I am doing wrong here.

 

Best regards

Labels (2)
0 Karma

inventsekar
SplunkTrust
SplunkTrust

this should be tested. maybe i will give it a try today evening. 

well, looks like the developers made some basic errors.. even if we raise support ticket for this, splunk would consider this as low priority ticket. 

 

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...