Quantcast
Channel: Latest Questions on Splunk Answers
Viewing all articles
Browse latest Browse all 13053

Search App no results displayed

$
0
0

Hello, My SearchHead(s) Search App’s Summary Dashboard does not display any information in the All indexed data, Sources , Source Types, and Hosts panels. I can seem to figure out why; however, I am able to search all my indexes just fine.

I am running a Distributed search setup where my SearchHead(s) DO NOT INDEX instead each SearchHead has the Light Forwarder App Enabled and _internal index is being forwared. Below is a btool dump of outputs.conf fromthe searchhead.

[tcpout]
system     autoLBFrequency = 30
system     blockOnCloning = true
system     compressed = false
system     connectionTimeout = 20
searchhead defaultGroup = ssl-autolb-group
system     disabled = false
system     dropClonedEventsOnQueueFull = 5
system     dropEventsOnQueueFull = -1
system     forceTimebasedAutoLB = false
SplunkForw forwardedindex.0.whitelist = .*
SplunkForw forwardedindex.1.blacklist = _.*
SplunkForw forwardedindex.2.whitelist = _audit
searchhead forwardedindex.3.whitelist = _internal
SplunkForw forwardedindex.filter.disable = false
system     heartbeatFrequency = 30
system     indexAndForward = false
system     maxConnectionsPerIndexer = 2
system     maxFailuresPerInterval = 2
SplunkForw maxQueueSize = 500KB
system     readTimeout = 300
system     secsInFailureInterval = 1
system     sendCookedData = true
system     useACK = false
system     writeTimeout = 300
searchhead [tcpout:ssl-autolb-group]
searchhead autoLB = true
searchhead autoLBFrequency = 30
searchhead compressed = true
searchhead disabled = false
searchhead forceTimebasedAutoLB = true
searchhead server = myindexer01:9997, myindexer02:9997,myindexer03:9997
searchhead sslCertPath = $SPLUNK_HOME/etc/apps/mycustome_app/bin/auth/splunkCombinedCert.pem
searchhead sslRootCAPath = $SPLUNK_HOME/etc/apps/mycustome_app/bin/auth/SplunkCAcert.pem
searchhead sslVerifyServerCert = false
searchhead useACK = true
Thanks in advance.


Viewing all articles
Browse latest Browse all 13053

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>