Splunk Dev

help on splunk index not working

jip31
Motivator

hi

we have create new index on our platform but they collect any data

The inputs.conf stanza are welll configurated with the new index name but our index are empty

So i try to list the check to do in order to make our index working

thanks

Labels (1)
Tags (1)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

How and where did you create the index?  It must be on the indexers and (optionally) on the search heads.  If the index was added by editing indexes.conf then the Splunk instances must be restarted.

Ensure the inputs.conf files use the *exact* same index name that was created.  Also, be sure to use the right index name when searching for data.

Check splunkd.log to see if the indexers are reporting errors writing to the new index.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

How and where did you create the index?  It must be on the indexers and (optionally) on the search heads.  If the index was added by editing indexes.conf then the Splunk instances must be restarted.

Ensure the inputs.conf files use the *exact* same index name that was created.  Also, be sure to use the right index name when searching for data.

Check splunkd.log to see if the indexers are reporting errors writing to the new index.

---
If this reply helps you, Karma would be appreciated.
0 Karma

jip31
Motivator

They have been created on indexers and the instance has been restarted

The index name is the same

Now i have a message issue when I am doing index=*

Message "Serach not executed: The minimum free disk space (5000MB) reached for opt/splunk/var/run/splunk/dispatch/

What do you think about this?

0 Karma

PickleRick
SplunkTrust
SplunkTrust

We think that you need some maintenance because you're running out of disk space.

Anyway, searching for raw events across all indexes (index=*) is very ineffective and generally should not be used at all. Typically you either look for some high-level stats which can be obtained much more effectively with tstats command or you should be way way more specific about your searching criteria.

Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...