Indexes screen not showing Event counts and earliest latest details

[KeithH]

Hi,

I am new to splunk but have noticed that in the Settings- Indexes screen there are columns for these values:

• Event Count
• Earliest Event
• Latest Event

These are very useful but one one particular installation I am supporting there are no values for these columns and the current size for all these indexes shows as 1MB.

Splunk version is 7.3.6

Any idea what could be causing this?

Thanks

[scelikok]

Hi @KeithH,

On your search results "splunk_server" field shows "2". This means you have 2 indexers. If you check that field you can see indexers hostnames. 

Or you can try the below link to see your indexers;

https://splunk_address:port/en-US/manager/search/search/distributed/peers

[gcusello]

Hi @KeithH,

if you have novalues in the indexes eventcount , this means tha tyou haven't events in that index.

The reason of this can be many:

at first are you viewing a Search Head, an Indexer cluster, an Indexer or a stand alone machine?

Then, how are you ingesting data in that index?

you should share some additional info.

Ciao.

Giuseppe

[KeithH]

Hi Giuseppe,

You are right I didn't put enough info in.  I am signing onto the main search head which is on the same box as Indexer 1 (of 2).  All the event count details are blank for all indexes but I can search on most of them and find very recent transactions.  See screenshots below

I am guessing that perhaps the search head (even though its on the same server) is a different instance from the indexer and perhaps I have to sign on to the indexers webpage to see these counts.  But that seems a bit daft and I dont know what the url for the indexer would be.

Any other suggestions?