I have inherited a fairly undocumented splunk deployment which looks as follows (splunk 4.3.2): Forwarders -> 2x Heavy Forwarders -> 3x Indexers -> Search Head I have added an index to the Search Head via the web interface and installed two forwarders with an inputs.conf as below: [monitor:////opt/tld/glassfish/domains/tldcs/logs/feedback.log] sourcetype = tld_gameplay index = tld_gameplay [monitor:////home/tldcs/web/apps/cstools/log/production.log] index = customer_service [monitor:////opt/tld/glassfish/domains/tldcs/logs/server.log] index = customer_service [monitor:////opt/tld/glassfish/domains/tldcs/logs/services.log] index = customer_service The issue is that I am not seeing any events in the web interface. How can I debug this? What information do you need from me, so that I can help you? How can I verify that data is, or is not, even being received by the heavy forwarder, and then the indexers? I am unclear whether I need to "add" the index somewhere else other than via the web interface. Thanks, ... View more