Getting Data In

Why are we unable to find the input source of an index?

ahmadsaadwarrai
Explorer

I am a bit new to Splunk and I am stuck with finding the source of an index.

I have index "summary_cherwellobject" in /opt/splunk/etc/slave-apps/_cluster/local/indexes.conf and data is coming in this index.

[summary_cherwellobject]
homePath   = $SPLUNK_DB/summary_cherwellobject/db
coldPath   = $SPLUNK_DB/summary_cherwellobject/colddb
thawedPath = $SPLUNK_DB/summary_cherwellobject/thaweddb
repFactor = auto

But I don't know how data is coming. I am unable to find source file and nothing that is mentioned is related to this index in inputs.conf.

When I see the index detail: Instance report from monitoring console, it says:
host is master.dr, source is summary_cherwellobject and sourcetype is stash.

So let please help me in finding the source input of this index?

0 Karma
1 Solution

MuS
SplunkTrust
SplunkTrust

Hi ahmadsaadwarraich,

the index name and sourcetype stash indicated that your source is a scheduled saved search, use this search to find the saved search:

| rest /services/saved/searches | search auto_summarize=1 | table title eai:acl.app

Title is the name of the saved search and eat:acl.app the name of the app where the search is saved.

Hope this helps ...

cheers, MuS

View solution in original post

woodcock
Esteemed Legend

The stash sourcetype indicates that the index is a summary index and probably is receiving events from a search that has | collect in it. You can search for this like this:

| rest /servicesNS/-/-/saved/searches splunk_server=local
| regex search="(?ms)\|\s*collect\s+"
0 Karma

woodcock
Esteemed Legend

If you put my answer and the one from @MuS together, you have it all covered.

0 Karma

MuS
SplunkTrust
SplunkTrust

Hi ahmadsaadwarraich,

the index name and sourcetype stash indicated that your source is a scheduled saved search, use this search to find the saved search:

| rest /services/saved/searches | search auto_summarize=1 | table title eai:acl.app

Title is the name of the saved search and eat:acl.app the name of the app where the search is saved.

Hope this helps ...

cheers, MuS

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...