Hi everyone,
I'm new to Splunk and this is the first Index I created, so hopefully this Question ain't to nooby ;)
This is my inputs.conf:
[monitor:///var/log/app/retry.log]
disabled=false
sourcetype=log4j
index=retry
multiline_event_extra_waittime = true
indexes.conf:
[retry]
homePath=$SPLUNK_DB/retry/db
coldPath=$SPLUNK_DB/retry/colddb
thawedPath=$SPLUNK_DB/retry/thaweddb
repFactor=autor
maxDataSize=auto
Cluster Bundle Status:
master
cluster_status=None
active_bundle
checksum=2924BEA962D9C72179B8CF4D03846EAB
timestamp=1533281547 (in localtime=Fri Aug 3 09:32:27 2018)
latest_bundle
checksum=2924BEA962D9C72179B8CF4D03846EAB
timestamp=1533281547 (in localtime=Fri Aug 3 09:32:27 2018)
last_validated_bundle
checksum=2924BEA962D9C72179B8CF4D03846EAB
last_validation_succeeded=1
timestamp=1533281547 (in localtime=Fri Aug 3 09:32:27 2018)
last_check_restart_bundle
last_check_restart_result=restart not required
checksum=
timestamp=0 (in localtime=Thu Jan 1 01:00:00 1970)
splunkidx2 3F5EEC11-8718-4C0D-AEF7-0F54DABB1D01 default
active_bundle=2924BEA962D9C72179B8CF4D03846EAB
latest_bundle=2924BEA962D9C72179B8CF4D03846EAB
last_validated_bundle=2924BEA962D9C72179B8CF4D03846EAB
last_bundle_validation_status=success
restart_required_apply_bundle=0
status=Up
splunkidx3 79FD9BAC-9F72-46CB-A043-EDCA31DE8EB7 default
active_bundle=2924BEA962D9C72179B8CF4D03846EAB
latest_bundle=2924BEA962D9C72179B8CF4D03846EAB
last_validated_bundle=2924BEA962D9C72179B8CF4D03846EAB
last_bundle_validation_status=success
restart_required_apply_bundle=0
status=Up
splunkidx1 D2077BB4-988A-46F2-BB00-E261EBF94BC9 default
active_bundle=2924BEA962D9C72179B8CF4D03846EAB
latest_bundle=2924BEA962D9C72179B8CF4D03846EAB
last_validated_bundle=2924BEA962D9C72179B8CF4D03846EAB
last_bundle_validation_status=success
restart_required_apply_bundle=0
status=Up
I can see the new "retry" Index in Splunk and add it to roles. But I can't search for it, or find events when search for "index=retry".
But I can see the rawdata/db on the Indexers, so Data is here.
Any Idea what I could have missed?
Thanks in advance!
↧