An index is shown under default search for a role, but why is a search on this index producing "No result" on the search head?

[u192612]

Hello Team,

xyz_prd_index created, running forwarder fine on the host. It displays all indexers too when we do listforward with the manage script. Also In role/user, showing this index under default search. But not showing any indexed data for this index in search head..it showing "no result".
Also restricted this index under role too like (index=xyz_prd_index)..

Appreciate if you can assist here ..

Thanks,

[sundareshr]

What timerange you searching? Try alltime

[skoelpin]

I think I understand what your asking, you want to know why the data from your remote host isn't available in the Splunk GUI when searching for it right?

So my question is, how do you know the forwarder is forwarding the data? Did you define the xyz_prd_index in your inputs.conf on your forwarder? Is this a new index?