From this line in the splunkd.log it appears the forwarder and receiver are connected?
/opt/splunkforwarder/var/log/splunk# vim splunkd.log
04-02-2012 19:54:28.351 +0000 INFO TcpOutputProc - Connected to idx=10.140.13.XX:9997
But I dont see any indication on the receiving splunk web application that it is receiving new data?
Where should I begin debugging?
There are some searches that might help you diagnose, see I can't find my data! in the Troubleshooting Manual.
View solution in original post