Error to search data

[rajuljain199005]

I am working on forwarder and enable my server1 as receiver & server 2 as forwarder. When I am adding data in any index in server 2 , it added successfully, but I am unable to see/search any event in that index . The surprising part is I am able to see the same data in my Spunk receiver which I got from forwarder instance(i.e. server 2). Why this issue. I am unable to figure out the root cause.
I added eventlog too, but inside index showing 0 events. those log events are visible in receiver sever(server 1). Why not in server where the forwarding enabled?

[MuS]

Hi rajuljain19900526,

assuming you installed the full Splunk version on both (not only the universal forwarder on your forwarding server2), then this will be the default behavior for Splunk on server2. If you want Splunk on server2 to locally index and forward the events to server1 read the docs http://docs.splunk.com/Documentation/Splunk/6.2.1/Forwarding/Routeandfilterdatad#Perform_selective_i...

Index all the data before forwarding it. To do this, just enable the indexAndForward attribute in outputs.conf.

Or goto Settings » Forwarding and receiving » Forwarding defaults in the UI and select

Store a local copy of forwarded events?

Hope this helps ...

cheers, MuS