Getting Data In

finding out if my forwarded data is placed in the receiver

Path Finder

I'm forwarding data from a windows splunk instance to a freebsd. I checked the index that i'm forwarding data to, so I could notice that its length is increasing.

But this indexed data on the receiver instance isn't showing up on the summary menu, and when I create a search that looks for that index, it shows me data fields of index that I have already performed a delete.

I'm getting confused with all these stuffs, because I cleaned all the data inputs and those index. So how could one field that was already deleted be there???

OK. 1 - I created in both splunk instances one index called disk_index. 2 - I'm running to pick up the indexed data the search: index="disk_index" 3 - I typed in both servers ./splunk clean eventdata So I cleaned ALL the indexes, right ?

Tags (2)
0 Karma

Splunk Employee
Splunk Employee

Your question is not really clear and i believe there is more than one issue here..
So, let's see if i can ask you a couple of questions to determine exactly what you are doing/asking:

1 - What index are you forwarding to?
2 - What is the search that you are using to search for the data?
3 - How exactly did you clean your data inputs in the index?

If possible please update (edit) your original question with more details and we can get back to you with more info.


0 Karma
Get Updates on the Splunk Community!

Observability Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...

Security Newsletter Updates | March 2023

 March 2023 | Check out the latest and greatestUnify Your Security Operations with Splunk Mission Control The ...

Platform Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestIntroducing Splunk Edge Processor, simplified data ...