How to fix Splunk index pipeline?

[Solo69]

Have anyone an idea how to fix this? 

Any suggestion? Thank you

[m_pham]

Try going into your monitoring console app > Settings > General Setup - then click on Apply Changes to see if that fixes your issue.

Double check this page again to be safe: https://docs.splunk.com/Documentation/Splunk/9.1.0/DMC/Configureindistributedmode

[Solo69]

Worked. Thanks 

[gcusello]

Hi @Solo69,

this should be the Monitoring Console that works with internal logs, did you forwarded internal log of that machine to your indexers?

Ciao.

Giuseppe

[Solo69]

They're forwarding their internal logs

[Simple_Search]

Are permissions interfering with your implementation - Are all files owned by splunk:splunk or does root have ownership of some items?