Splunk Enterprise

With data not indexing, what are other steps to follow to get data in index XYZ?

Santosh2
New Member

Index=XYZ  source= abc*.logs host=kfg 

So I when I checked in internal index data is coming from host, I checked forwarder server class mapping is fine, I could see the data is deploying. But still cannot see data.

What other steps i need to follow to get data in index XYZ

 

Labels (1)
Tags (1)
0 Karma

gcusello
Legend

Hi @Santosh2,

maybe the timestamp isn't correctly parsed, try to search something special of your logs in a very large time period.

Then, if you're searching logs in the first 11 days of the month, try to search the 1st of may (01/05/2022) at the 5th of january (05/01/2022).

Then, are you sure about index?

then, try to add an asterisk at the beginning of the source, maybe there's the full path and/ot an asterisk at the end of host, maybe there's the FQDN name instead of the hostname.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...