Splunk Search

Data from HP-UX seems to be missing

rajbahak
Path Finder

Hello,

We installed universal forwarders on a few HP-UX systems and they seem to connect to the splunk indexers fine but we can't find any data coming from these hosts when we go search for them. (The hostname doesn't even show up in the search app)

I say they seem to connect fine because I can see the universal forwarder getting listed under 'All Forwarders' tab of the Deployment Monitor app. Also, the forwarder log file logged successful conncetion to idx (TcpOutputProc - Connected to idx=xxx.xxx.xxx.xxx:9997)

What might be cauing the data from these HP-UX hosts not show up in Splunk?

Thanks a lot

Tags (1)
0 Karma

lguinn2
Legend

If you are using the UNIX app, the data will be going into index=os Try this search

index=* | stats count by host sourcetype source
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...