Hello,
I have 2 Indexers along with 1 search head. Both the indexers are added under distributed search peer. From a universal forwarder, I followed the method to add data from Files and Directories from Forwarded Inputs. After add the inputs, no events are showing on any of the indexers. At the same time, got a message below:
Search peer INDEXER-02 has the following message: Received event for unconfigured/disabled/deleted index=abc with source="source::/opt/log/abc/abc.log" host="host::abc" sourcetype="sourcetype::abc.log". So far received events from 1 missing index(es).
Note that, I have an additional indexer name "abc" on INDEXER-01. Is this message for the Indexer "abc" not found @INDEXER-02 ?
Why is the added data not available at the Search Head? Thanks in advance for your help.
↧
