Getting Data In

finding out if my forwarded data is placed in the receiver

Path Finder

I'm forwarding data from a windows splunk instance to a freebsd. I checked the index that i'm forwarding data to, so I could notice that its length is increasing.

But this indexed data on the receiver instance isn't showing up on the summary menu, and when I create a search that looks for that index, it shows me data fields of index that I have already performed a delete.

I'm getting confused with all these stuffs, because I cleaned all the data inputs and those index. So how could one field that was already deleted be there???

OK. 1 - I created in both splunk instances one index called disk_index. 2 - I'm running to pick up the indexed data the search: index="disk_index" 3 - I typed in both servers ./splunk clean eventdata So I cleaned ALL the indexes, right ?

Tags (2)
0 Karma

Splunk Employee
Splunk Employee

Your question is not really clear and i believe there is more than one issue here..
So, let's see if i can ask you a couple of questions to determine exactly what you are doing/asking:

1 - What index are you forwarding to?
2 - What is the search that you are using to search for the data?
3 - How exactly did you clean your data inputs in the index?

If possible please update (edit) your original question with more details and we can get back to you with more info.


0 Karma
Get Updates on the Splunk Community!

Splunk APM & RUM | Upcoming Planned Maintenance

There will be planned maintenance of the streaming infrastructure for Splunk APM and Splunk RUM in the coming ...

Part 2: Diving Deeper With AIOps

Getting the Most Out of Event Correlation and Alert Storm Detection in Splunk IT Service Intelligence   Watch ...

User Groups | Upcoming Events!

If by chance you weren't already aware, the Splunk Community is host to numerous User Groups, organized ...