Getting Data In

How to show a deployed index in Splunk Web on a search head to add data?

YoungDaniel
Path Finder

Hi,

We are using a Splunk Enterprise installation that uses the following:
1 search head, also acts as a deployment server and license manager.
1 indexer, with no gui.

I have created a deployment app on the Search head called test-indexes. It contains a /test-indexes/default/indexes.conf
In indexes.conf I have created an index called [test] with the default bucket paths, maxdatasize and maxtotaldatasize attributes.

The index has been deployed on the indexer, and is visible in opt/splunk/var/lib/splunk directory. both in test.dat and test directory.

My issue is that even though the index is deployed, there is no way for me to be able to add data to the index from the search head.
It does not exist in the settings->indexes view in Splunk Web (search head).

How can I resolve this issue?

// Daniel

0 Karma
1 Solution

renjith_nair
SplunkTrust
SplunkTrust

You will be able to add data only to local indexes through web , ie; index which are created on search head. To load data to test index on indexer, you have to either use indexer's web or configure forwarder to forward data.

Happy Splunking!

View solution in original post

renjith_nair
SplunkTrust
SplunkTrust

You will be able to add data only to local indexes through web , ie; index which are created on search head. To load data to test index on indexer, you have to either use indexer's web or configure forwarder to forward data.

Happy Splunking!

YoungDaniel
Path Finder

Ok, but running the | dbinspect index=test command didn't render any results even though bucket paths are declared. Is that because there is no data in the index?

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

Easiest way to find whether the index is created is ,
Click Settings > Access Controls edit or add a role and check in "Indexes searched by default" section to see if the index is listed.
or
run
|tstats count where index=* and see if your index is listed

Happy Splunking!
0 Karma
Get Updates on the Splunk Community!

Introducing Ingest Actions: Filter, Mask, Route, Repeat

WATCH NOW Ingest Actions (IA) is the best new way to easily filter, mask and route your data in Splunk® ...

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...