finding out if my forwarded data is placed in the receiver

[Caio_Santos]

I'm forwarding data from a windows splunk instance to a freebsd. I checked the index that i'm forwarding data to, so I could notice that its length is increasing.

But this indexed data on the receiver instance isn't showing up on the summary menu, and when I create a search that looks for that index, it shows me data fields of index that I have already performed a delete.

I'm getting confused with all these stuffs, because I cleaned all the data inputs and those index. So how could one field that was already deleted be there???

OK. 1 - I created in both splunk instances one index called disk_index. 2 - I'm running to pick up the indexed data the search: index="disk_index" 3 - I typed in both servers ./splunk clean eventdata So I cleaned ALL the indexes, right ?

[Genti]

Caio,
Your question is not really clear and i believe there is more than one issue here..
So, let's see if i can ask you a couple of questions to determine exactly what you are doing/asking:

1 - What index are you forwarding to?
2 - What is the search that you are using to search for the data?
3 - How exactly did you clean your data inputs in the index?

If possible please update (edit) your original question with more details and we can get back to you with more info.

Cheers,
.gz