Getting Data In
Highlighted

Why are no events showing on any indexers after using "Add Data" on the universal forwarder?

Hello,

I have 2 Indexers along with 1 search head. Both the indexers are added under distributed search peer. From a universal forwarder, I followed the method to add data from Files and Directories from Forwarded Inputs. After add the inputs, no events are showing on any of the indexers. At the same time, got a message below:

Search peer INDEXER-02 has the following message: Received event for unconfigured/disabled/deleted index=abc with source="source::/opt/log/abc/abc.log" host="host::abc" sourcetype="sourcetype::abc.log". So far received events from 1 missing index(es).

Note that, I have an additional indexer name "abc" on INDEXER-01. Is this message for the Indexer "abc" not found @INDEXER-02 ?
Why is the added data not available at the Search Head? Thanks in advance for your help.

0 Karma
Highlighted

Re: Why are no events showing on any indexers after using "Add Data" on the universal forwarder?

SplunkTrust
SplunkTrust

All of your indexers should have the same indexes defined. Otherwise, when an indexer receives data for an index it doesn't have that data is discarded. That is the reason for the error message you saw. Having index 'abc' defined on one index and not the other means your forwarders have a 50% chance of sending to the "right" indexer and a 50% chance the data will be lost.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

Highlighted

Re: Why are no events showing on any indexers after using "Add Data" on the universal forwarder?

After checking, both the Indexer having same indexes. But still cant even figure out the inputs data.

Any suggestion, where I am missing something.

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.