Installed Splunk but no Data!

[canton]

I have installed Splunk on server and can login to splunk and browse but no data is showing in search section waht so ever.

I have also configured via Manager » Data inputs » Files & Directories.

But still no luck what could be wrong?

Thanks in advance

[Genti · Accepted solution]

So, when you go to Manager » Data inputs » Files & Directories do you see the file/directory you added as listed? And does it show a number of files next to it?

Is this directory perhaps owned by a different user and the splunk service does not have appropriate permissions to monitor/read the files within?

Are you searching using the "all time" time-range? Perhaps this is historic data and not showing up in the timeframe you are searching?

Lastly, if you search for "index=_internal", do you see any data show up?

[Genti]

well, no, you have to be careful here. This means that you are receiving internal data. What about your OTHER data. Are you receiving the logs from the files that you already included in your data inputs?

[canton]

mmm after doing what you advised "index=_internal" all seemed to work or it may have been a coincidence.

regardless thank you for your help