I am hiting curl
curl -k "https://input-prd-p-XXXXXXXXX.cloud.splunk.com:8088/services/collector/raw?channel=00872DC6-AC83-4EDE-8AFE-8413C3825C4C&sourcetype=mydata&host=sahu" -H "Authorization: Splunk xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxx" -d 'ravisahu_anugrah_adams'
getting success response:
{"text":"Success","code":0,"ackId":7}
Still cant see data sent to splunk in search
Do an All-time
search for host=sahu _index_earliest=-5m
; the timestamp may be wrong/misinterpreted and it may not have landed where you expect it.
Hey, just in case, I'd try to run a search like this:
| tstats count where index=* and host=sahu by index host sourcetype
Run that search before and after you send something with curl, to see if you really don't get the data, or if just happens to land somewhere where you're not searching.
0 events before and after hitting curl
My asumption is I am not getting any Configure Receiver in 'Forwarding and receiving' section.
I think data is not going to splunk.
I checked sending data with forwarder also, but no luck
See my question
https://answers.splunk.com/answers/655567/i-dont-see-receive-data-section-under-settings-for.html
Search & Reporting dashboard says
What to Search
8,033 Events
INDEXED 10 days ago
EARLIEST EVENT 10 days ago
LATEST EVENT
I uploaded a test file back 10 days
No event after that