help on splunk index not working

[jip31]

hi

we have create new index on our platform but they collect any data

The inputs.conf stanza are welll configurated with the new index name but our index are empty

So i try to list the check to do in order to make our index working

thanks

[richgalloway · Accepted solution]

How and where did you create the index?  It must be on the indexers and (optionally) on the search heads.  If the index was added by editing indexes.conf then the Splunk instances must be restarted.

Ensure the inputs.conf files use the *exact* same index name that was created.  Also, be sure to use the right index name when searching for data.

Check splunkd.log to see if the indexers are reporting errors writing to the new index.

[jip31]

They have been created on indexers and the instance has been restarted

The index name is the same

Now i have a message issue when I am doing index=*

Message "Serach not executed: The minimum free disk space (5000MB) reached for opt/splunk/var/run/splunk/dispatch/

What do you think about this?

[PickleRick]

We think that you need some maintenance because you're running out of disk space.

Anyway, searching for raw events across all indexes (index=*) is very ineffective and generally should not be used at all. Typically you either look for some high-level stats which can be obtained much more effectively with tstats command or you should be way way more specific about your searching criteria.