Splunk Search

Data from HP-UX seems to be missing

rajbahak
Path Finder

Hello,

We installed universal forwarders on a few HP-UX systems and they seem to connect to the splunk indexers fine but we can't find any data coming from these hosts when we go search for them. (The hostname doesn't even show up in the search app)

I say they seem to connect fine because I can see the universal forwarder getting listed under 'All Forwarders' tab of the Deployment Monitor app. Also, the forwarder log file logged successful conncetion to idx (TcpOutputProc - Connected to idx=xxx.xxx.xxx.xxx:9997)

What might be cauing the data from these HP-UX hosts not show up in Splunk?

Thanks a lot

Tags (1)
0 Karma

lguinn2
Legend

If you are using the UNIX app, the data will be going into index=os Try this search

index=* | stats count by host sourcetype source
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...