Splunk Enterprise

Why can I not see the data in Splunk UI?

Santosh2
Path Finder

Hi all, I can see the logs coming in from a particular source=das*.log through backend Linux but when I search with the same source I cannot see data in ui 

One more thing if I use with index name and source also I am not getting any data in ui 

Note: when I searched with internal index I could see logs from that host IP but not from the source in ui 

Can any one help on this issue.

 

 

Labels (1)
Tags (1)
0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

@Santosh2 - You can take some predefined steps in case of data input issues:

  • Check if you have inputs.conf entry for these files
  • Have you specified the right index?
  • Have you created that index on the Indexer?
  • Make sure you are not filtering the data with transforms.conf config
    • check for queue=null line in transforms.conf 
    • If you see any, make sure it's not related to your data
  • Make sure you are receiving other data from that host.
    • index=_internal host=<hostname-that-has-inputs.conf> 
  • Make sure you have permission to read the index data and also make sure no other restriction being applied.
    • You can check with Splunk Admin.

 

I hope this helps!!! Upvote/karma would be appreciated!!

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...