I am working on forwarder and enable my server1 as receiver & server 2 as forwarder. When I am adding data in any index in server 2 , it added successfully, but I am unable to see/search any event in that index . The surprising part is I am able to see the same data in my Spunk receiver which I got from forwarder instance(i.e. server 2). Why this issue. I am unable to figure out the root cause.
I added eventlog too, but inside index showing 0 events. those log events are visible in receiver sever(server 1). Why not in server where the forwarding enabled?