Getting Data In

Why are the logs that are being forwarded to the indexer, cannot be seen on the search head?

prateedshetty
Path Finder

I can see the logs on the indexer but they aren't searchable on search head.

I've already checked for -

  • The index is main and is a default for the user.
  • Under monitoring console, I can see the indexer is UP and configured.

This indexer is also the license master.

0 Karma

p_gurav
Champion

Hi,

Follow the procedure in documents for adding search peer:

https://docs.splunk.com/Documentation/Splunk/7.0.2/DistSearch/Configuredistributedsearch

0 Karma

valiquet
Contributor

Have you added your idx as search peers?

You can try
|tstats count where index=* by index

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...