Splunk Search

I have a forwarder and indexer set up, but why am I unable to search logs from the search head?

Path Finder

I have a forwarder and an indexer.
I see the app is deployed in the forwarder at location etc/apps/.

Forwarders are up and running.
And log files have data as well.
But still the logs are not coming up on the Splunk search head.

  • props.conf is correct
  • inputs.conf is correct

Please guide, where else can I check and how to troubleshoot?

0 Karma

Builder

Try adding your indexer in Setttings/Distributed search/search peers first then monitor (tail -f) both splunkd.log on those servers to check if there are errors in authentication.

0 Karma

Influencer

Do you have an outputs.conf on your forwarder with indexer information in it to send the data to ?

0 Karma

SplunkTrust
SplunkTrust

Which app? When you checked the config files, did you look at the forwarder or search head?

---
If this reply helps you, an upvote would be appreciated.
0 Karma