Why are no events showing on any indexers after using "Add Data" on the universal forwarder?

[princemanto2580]

Hello,

I have 2 Indexers along with 1 search head. Both the indexers are added under distributed search peer. From a universal forwarder, I followed the method to add data from Files and Directories from Forwarded Inputs. After add the inputs, no events are showing on any of the indexers. At the same time, got a message below:

Search peer INDEXER-02 has the following message: Received event for unconfigured/disabled/deleted index=abc with source="source::/opt/log/abc/abc.log" host="host::abc" sourcetype="sourcetype::abc.log". So far received events from 1 missing index(es).

Note that, I have an additional indexer name "abc" on INDEXER-01. Is this message for the Indexer "abc" not found @INDEXER-02 ?
Why is the added data not available at the Search Head? Thanks in advance for your help.

[richgalloway · Accepted solution]

All of your indexers should have the same indexes defined. Otherwise, when an indexer receives data for an index it doesn't have that data is discarded. That is the reason for the error message you saw. Having index 'abc' defined on one index and not the other means your forwarders have a 50% chance of sending to the "right" indexer and a 50% chance the data will be lost.

[princemanto2580]

After checking, both the Indexer having same indexes. But still cant even figure out the inputs data.

Any suggestion, where I am missing something.