unable to get all event data to newly created index

[Jyo_Reel]

Hi Team,

I can see events related to all hosts in internal index but the only few hosts data is available in newly created index. Please help me to troubleshoot the issue.

Thanks in advance.

[PickleRick]

The _internal index collects Splunk's internal (hence the name) events. Generally, the underscore-beginning indexes are internal to Splunk and you can expect the data there to be governed by default Splunk settings (you can adjust some of them like retention period but that is not needed for them to work out of the box).

Everything else is up to you. We don't know what are your sources, what does your onboarding process look like what are your indexes and how should the data get into them.

So the question you stated is not for us - it's for your Splunk admins and architects. They should know what data should be ingested from where and land into which index. They should also know whether you are allowed to have access to that data because not everyone usually has access to every index.

[gcusello]

Hi @Jyo_Reel ,

in _internal index you see the Splunk logs, if you need other logs (e.g. operative system or appications), you have to install also the rerated add-ons (Linux https://splunkbase.splunk.com/app/833 or windows https://splunkbase.splunk.com/app/742 ) enabling the input stanzas that you want.

Having the _internal logs from all hosts is a good starting point because it means that you correctly configured your connections and there isn't any connection issue.

Ciao.

Giuseppe