Splunk kb store and logs recieving issue on indexer

[Dk123]

Hello. I have created an index under a custom app from splunk web it is reflecting but we I have set up the univarsal forwarder to monitor logs for same index it is not reflecting anything on indexer.

Also my kb store showing status failed and tell me to check mongod.log and splunk key   , please help in this

[livehybrid]

For your first issue, relating to the data not being received into Splunk, please check the your inputs.conf on the UF is setup to the same index name as you have defined in the indexes.conf on your indexers.

You should also check that your user has permissions to see this index on your searchhead.

Regarding the mongo issue, please can you confirm which version of Splunk you are running and if was a fresh install or an upgrade from a previous version?
Its worth starting with splunkd.log/mongod.log in $SPLUNK_HOME/var/log/splunk (or look in the _internal index for these logs) to see if there are any error/fatal/critical errors that might point to why Mongo isnt starting.

If you find anything in the logs then let us know here and we can try and help you work through it.

Regards

Will

[Dikshi]

Fresh installation 9.4.0 errors showing for kvstore provider , http connection error