How and where did you create the index? It must be on the indexers and (optionally) on the search heads. If the index was added by editing indexes.conf then the Splunk instances must be restarted.
Ensure the inputs.conf files use the *exact* same index name that was created. Also, be sure to use the right index name when searching for data.
Check splunkd.log to see if the indexers are reporting errors writing to the new index.
How and where did you create the index? It must be on the indexers and (optionally) on the search heads. If the index was added by editing indexes.conf then the Splunk instances must be restarted.
Ensure the inputs.conf files use the *exact* same index name that was created. Also, be sure to use the right index name when searching for data.
Check splunkd.log to see if the indexers are reporting errors writing to the new index.
They have been created on indexers and the instance has been restarted
The index name is the same
Now i have a message issue when I am doing index=*
Message "Serach not executed: The minimum free disk space (5000MB) reached for opt/splunk/var/run/splunk/dispatch/
What do you think about this?
We think that you need some maintenance because you're running out of disk space.
Anyway, searching for raw events across all indexes (index=*) is very ineffective and generally should not be used at all. Typically you either look for some high-level stats which can be obtained much more effectively with tstats command or you should be way way more specific about your searching criteria.