Search App no results displayed

[bmacias84]

Hello,
My SearchHead(s) Search App’s Summary Dashboard does not display any information in the All indexed data, Sources , Source Types, and Hosts panels. I can seem to figure out why; however, I am able to search all my indexes just fine.

I am running a Distributed search setup where my SearchHead(s) DO NOT INDEX instead each SearchHead has the Light Forwarder App Enabled and _internal index is being forwared. Below is a btool dump of outputs.conf fromthe searchhead.

[tcpout]

system     autoLBFrequency = 30

system     blockOnCloning = true

system     compressed = false

system     connectionTimeout = 20

searchhead defaultGroup = ssl-autolb-group

system     disabled = false

system     dropClonedEventsOnQueueFull = 5

system     dropEventsOnQueueFull = -1

system     forceTimebasedAutoLB = false

SplunkForw forwardedindex.0.whitelist = .*

SplunkForw forwardedindex.1.blacklist = _.*

SplunkForw forwardedindex.2.whitelist = _audit

searchhead forwardedindex.3.whitelist = _internal

SplunkForw forwardedindex.filter.disable = false

system     heartbeatFrequency = 30

system     indexAndForward = false

system     maxConnectionsPerIndexer = 2

system     maxFailuresPerInterval = 2

SplunkForw maxQueueSize = 500KB

system     readTimeout = 300

system     secsInFailureInterval = 1

system     sendCookedData = true

system     useACK = false

system     writeTimeout = 300

searchhead [tcpout:ssl-autolb-group]

searchhead autoLB = true

searchhead autoLBFrequency = 30

searchhead compressed = true

searchhead disabled = false

searchhead forceTimebasedAutoLB = true

searchhead server = myindexer01:9997, myindexer02:9997,myindexer03:9997

searchhead sslCertPath = $SPLUNK_HOME/etc/apps/mycustome_app/bin/auth/splunkCombinedCert.pem

searchhead sslRootCAPath = $SPLUNK_HOME/etc/apps/mycustome_app/bin/auth/SplunkCAcert.pem

searchhead sslVerifyServerCert = false

searchhead useACK = true

Thanks in advance.

[bmacias84 · Accepted solution]

Thanks @mzax for the answer.

The SplunkLightForwarder app is disabling the scheduler processor.
Make sure that the SplunkLightForwarder will be disabled in order for the scheduler processor to be active.

Additional sign that the processor is disabled can be found in splunkd.log:
WARN pipeline - Empty pipeline (no processors): scheduler, exiting pipeline
Find it using the following search:
index=_internal source=*splunkd.log scheduler pipeline

orginal post: oh-crap-scheduled-searches-have-stopped-running-without-any-apparent-reason

[bmacias84]

@rob_jordan,
No I have the same problem on the indexer and no to search heapooling.

[bandit]

Does the search app summary work directly on your indexers?
Do your search head have pooling enabled?