Getting Data In

Unversal Forwarder (win/*nix 9.1.1) with specific Index does not show up in Data summary anymore


Hi all,

I successfully forward data from Windows using the command

msiexec.exe /i splunkuniversalforwarder_x86.msi RECEIVING_INDEXER="indexer1:9997" WINEVENTLOG_SEC_ENABLE=1 WINEVENTLOG_SYS_ENABLE=1 AGREETOLICENSE=Yes /quiet

from Install a Windows universal forwarder .

The same for Linux with the command

./splunk add monitor /var/log

from Configure the universal forwarder using configuration files .

Both works fine and I can see the hosts in the Data Summary as visible in the following figure.

Data SummaryData Summary

If I instead set up the input in the local "inputs.conf" file after basic installation like

interval = 10
object = PhysicalDisk
counters = Disk Bytes/sec; % Disk Read Time; % Disk Write Time; % Disk Time
instances = *
disabled = 0
index = winfwtestinger

for example and assign a specific index, I can see that data is ingested if I search for the specific index but they will not appear in the Data Summary. I would be very happy about any suggestion what I am doing wrong here.


Best regards

Labels (2)
0 Karma


this should be tested. maybe i will give it a try today evening. 

well, looks like the developers made some basic errors.. even if we raise support ticket for this, splunk would consider this as low priority ticket. 


0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...