Getting Data In

finding out if my forwarded data is placed in the receiver

Path Finder

I'm forwarding data from a windows splunk instance to a freebsd. I checked the index that i'm forwarding data to, so I could notice that its length is increasing.

But this indexed data on the receiver instance isn't showing up on the summary menu, and when I create a search that looks for that index, it shows me data fields of index that I have already performed a delete.

I'm getting confused with all these stuffs, because I cleaned all the data inputs and those index. So how could one field that was already deleted be there???

OK. 1 - I created in both splunk instances one index called disk_index. 2 - I'm running to pick up the indexed data the search: index="disk_index" 3 - I typed in both servers ./splunk clean eventdata So I cleaned ALL the indexes, right ?

Tags (2)
0 Karma

Splunk Employee
Splunk Employee

Your question is not really clear and i believe there is more than one issue here..
So, let's see if i can ask you a couple of questions to determine exactly what you are doing/asking:

1 - What index are you forwarding to?
2 - What is the search that you are using to search for the data?
3 - How exactly did you clean your data inputs in the index?

If possible please update (edit) your original question with more details and we can get back to you with more info.


0 Karma
Get Updates on the Splunk Community!

Splunk Security Content for Threat Detection & Response, Q1 Roundup

Join Principal Threat Researcher, Michael Haag, as he walks through:An introduction to the Splunk Threat ...

Splunk Life | Happy Pride Month!

Happy Pride Month, Splunk Community! 🌈 In the United States, as well as many countries around the ...

SplunkTrust | Where Are They Now - Michael Uschmann

The Background Five years ago, Splunk published several videos showcasing members of the SplunkTrust to share ...