Getting Data In

splunk indexer does not show events from all indexes from same forwarder

i2sheri
Communicator

I have a linux forwarder sending events to linux indexer. I can search for events in _internal index and events configured in inputs to one index (say index1) but not the second index (say index2).

index2 was not created when I configured the forwarder so I saw

received event for unconfigured/disabled/deleted index=index2

Later I've created index2, but still i do not see events in index2. I've restarted forwarder after creating the index

0 Karma
1 Solution

i2sheri
Communicator

I've created the index in an indexer cluster and I applied the cluster bundle where all the indexes are created, but this index2 is configured to another indexer which is not part of the cluster. Creating the index on the indexer fixed the problem.

Learnt another lesson.

View solution in original post

i2sheri
Communicator

I've created the index in an indexer cluster and I applied the cluster bundle where all the indexes are created, but this index2 is configured to another indexer which is not part of the cluster. Creating the index on the indexer fixed the problem.

Learnt another lesson.

diogofgm
SplunkTrust
SplunkTrust

After creating the index you should restart the indexer not the forwarder

------------
Hope I was able to help you. If so, some karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...