Splunk Search

An index is shown under default search for a role, but why is a search on this index producing "No result" on the search head?

New Member

Hello Team,

xyz_prd_index created, running forwarder fine on the host. It displays all indexers too when we do listforward with the manage script. Also In role/user, showing this index under default search. But not showing any indexed data for this index in search head..it showing "no result".
Also restricted this index under role too like (index=xyz_prd_index)..

Appreciate if you can assist here ..


0 Karma


What timerange you searching? Try alltime

0 Karma


I think I understand what your asking, you want to know why the data from your remote host isn't available in the Splunk GUI when searching for it right?

So my question is, how do you know the forwarder is forwarding the data? Did you define the xyz_prd_index in your inputs.conf on your forwarder? Is this a new index?

0 Karma
Get Updates on the Splunk Community!

Data Preparation Made Easy: SPL2 for Edge Processor

By now, you may have heard the exciting news that Edge Processor, the easy-to-use Splunk data preparation tool ...

Introducing Edge Processor: Next Gen Data Transformation

We get it - not only can it take a lot of time, money and resources to get data into Splunk, but it also takes ...

Tips & Tricks When Using Ingest Actions

Tune in to learn about:Large scale architecture when using Ingest ActionsRegEx performance considerations ...