I'm forwarding data from a windows splunk instance to a freebsd. I checked the index that i'm forwarding data to, so I could notice that its length is increasing.
But this indexed data on the receiver instance isn't showing up on the summary menu, and when I create a search that looks for that index, it shows me data fields of index that I have already performed a delete.
I'm getting confused with all these stuffs, because I cleaned all the data inputs and those index. So how could one field that was already deleted be there???
OK.
1 - I created in both splunk instances one index called disk_index.
2 - I'm running to pick up the indexed data the search: index="disk_index"
3 - I typed in both servers ./splunk clean eventdata So I cleaned ALL the indexes, right ?
