I have 2 spunk instances: An indexing server and the web interface. Due to a mixup I'm having to send logs to the web interface (what I'm calling this Splunk server, since all it does is allow you to connect and sort through indexing data).

I've confirmed the web int. has the correct indexer already configured. And that the forwarder and indexer are already connected.

The forwarder is pointing to the correct logs. And is configured to use the specific indexer.

However, I'm not seeing any logs within the Splunk web interface. Even more perplexing - I'm not seeing any errors in the Splunk forwarder and web int. logs. I'm unsure where the issue rests... if one even exists.

I admit, some assistance with this would be appreciated.

Side note: both the indexing server and web interface server are configured with the same index. But do to issues that can't be resolved without an overhaul to the server environment, I have to use the web server.

• bossrhino