I have a forwarder and indexer set up, but why am I unable to search logs from the search head?

[joydeep741]

I have a forwarder and an indexer.
I see the app is deployed in the forwarder at location etc/apps/.

Forwarders are up and running.
And log files have data as well.
But still the logs are not coming up on the Splunk search head.

• props.conf is correct
• inputs.conf is correct

Please guide, where else can I check and how to troubleshoot?

[splunkreal]

Try adding your indexer in Setttings/Distributed search/search peers first then monitor (tail -f) both splunkd.log on those servers to check if there are errors in authentication.

[pradeepkumarg]

Do you have an outputs.conf on your forwarder with indexer information in it to send the data to ?

[richgalloway]

Which app? When you checked the config files, did you look at the forwarder or search head?