Splunk Search

Error to search data

rajuljain199005
New Member

I am working on forwarder and enable my server1 as receiver & server 2 as forwarder. When I am adding data in any index in server 2 , it added successfully, but I am unable to see/search any event in that index . The surprising part is I am able to see the same data in my Spunk receiver which I got from forwarder instance(i.e. server 2). Why this issue. I am unable to figure out the root cause.
I added eventlog too, but inside index showing 0 events. those log events are visible in receiver sever(server 1). Why not in server where the forwarding enabled?

0 Karma

MuS
SplunkTrust
SplunkTrust

Hi rajuljain19900526,

assuming you installed the full Splunk version on both (not only the universal forwarder on your forwarding server2), then this will be the default behavior for Splunk on server2. If you want Splunk on server2 to locally index and forward the events to server1 read the docs http://docs.splunk.com/Documentation/Splunk/6.2.1/Forwarding/Routeandfilterdatad#Perform_selective_i...

Index all the data before forwarding it. To do this, just enable the indexAndForward attribute in outputs.conf.

Or goto Settings » Forwarding and receiving » Forwarding defaults in the UI and select

Store a local copy of forwarded events?

Hope this helps ...

cheers, MuS

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...