Splunk Enterprise

With data not indexing, what are other steps to follow to get data in index XYZ?

Santosh2
New Member

Index=XYZ  source= abc*.logs host=kfg 

So I when I checked in internal index data is coming from host, I checked forwarder server class mapping is fine, I could see the data is deploying. But still cannot see data.

What other steps i need to follow to get data in index XYZ

 

Labels (1)
Tags (1)
0 Karma

gcusello
Legend

Hi @Santosh2,

maybe the timestamp isn't correctly parsed, try to search something special of your logs in a very large time period.

Then, if you're searching logs in the first 11 days of the month, try to search the 1st of may (01/05/2022) at the 5th of january (05/01/2022).

Then, are you sure about index?

then, try to add an asterisk at the beginning of the source, maybe there's the full path and/ot an asterisk at the end of host, maybe there's the FQDN name instead of the hostname.

Ciao.

Giuseppe

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>