new index not accepting data

[damucka]

Hello,

I am not able to get my data into the newly created "varlog" index. The index is an event index and active in the system. I am not able to see any issues with it. I have the following inputs.conf stanza:

[default]

host = ccd03v005084

[monitor:///var/log/*]

index = varlog

disabled = 0

interval = 15

sourcetype = syslog

Interesting, when I change "varlog" with "main" I am getting the data into the "main".

Can it be, that this is due to the Splunk Enterprise Trial license that I am using? Would the trial license allow creation and data indexing in the new indexes?

If not, how would I investigate it further? There is no sign of any problems neither in the splunkd.log of the forwarder nor anywhere else I checked.

Kind Regards,

Kamil

[gcusello · Accepted solution]

Hi @damucka,

in general, there isn't any reason because logs aren't stored in varlog index, and they are correctly stored in main index.

Could you share the indexes.conf where is defined the varlog index?

Check if the name is correct and if the folder are correctly created in file system.

The trial license has no affects on your problem.

Ciao.

Giuseppe

[damucka]

The name is correct and the folders are there ....

The only thing is, that this is the Kubernetes cluster so I am not sure how the interaction here is.

[aashiqwork]

Go to the Search Head and search with the below search (Make sure you have rights to see internal indexes data):

index=_internal | dedup host | fields host | table host

Look in the list to see if your Forwarder’s hostname is in the list, if it is present that means the Forwarder is connected. 

[aashiqwork]

Does your varlog index has necessary permissions for indexing the data.

Thanks

A

[damucka]

@aashiqwork 

Could you please more precisely specify where would I find the setting to permit my "varlog" index the indexing?

I thought naively if I create it in the "search" app context it would accept whatever comes ...

Kind Regards,

Kamil