Getting Data In

Unversal Forwarder (win/*nix 9.1.1) with specific Index does not show up in Data summary anymore

benesch
Observer

Hi all,

I successfully forward data from Windows using the command

msiexec.exe /i splunkuniversalforwarder_x86.msi RECEIVING_INDEXER="indexer1:9997" WINEVENTLOG_SEC_ENABLE=1 WINEVENTLOG_SYS_ENABLE=1 AGREETOLICENSE=Yes /quiet

from Install a Windows universal forwarder .

The same for Linux with the command

./splunk add monitor /var/log

from Configure the universal forwarder using configuration files .

Both works fine and I can see the hosts in the Data Summary as visible in the following figure.

Data SummaryData Summary

If I instead set up the input in the local "inputs.conf" file after basic installation like

[perfmon://LocalPhysicalDisk]
interval = 10
object = PhysicalDisk
counters = Disk Bytes/sec; % Disk Read Time; % Disk Write Time; % Disk Time
instances = *
disabled = 0
index = winfwtestinger

for example and assign a specific index, I can see that data is ingested if I search for the specific index but they will not appear in the Data Summary. I would be very happy about any suggestion what I am doing wrong here.

 

Best regards

Labels (2)
0 Karma

inventsekar
SplunkTrust
SplunkTrust

this should be tested. maybe i will give it a try today evening. 

well, looks like the developers made some basic errors.. even if we raise support ticket for this, splunk would consider this as low priority ticket. 

 

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma
Get Updates on the Splunk Community!

Developer Spotlight with Paul Stout

Welcome to our very first developer spotlight release series where we'll feature some awesome Splunk ...

State of Splunk Careers 2024: Maximizing Career Outcomes and the Continued Value of ...

For the past four years, Splunk has partnered with Enterprise Strategy Group to conduct a survey that gauges ...

Data-Driven Success: Splunk & Financial Services

Splunk streamlines the process of extracting insights from large volumes of data. In this fast-paced world, ...