Applicability

Description

An issue may be observed where Log Observer Connect successfully ingests logs from several Splunk indexes, but one particular index is not visible in the Log Connection configuration or queryable in Splunk Observability Cloud.

Common characteristics of this scenario include:

• No Log Observer Connect–related errors present in the _internal index.
• The Log Observer Connect service account has confirmed read access to the affected index.
• The index contains data and can be queried directly in Splunk Cloud Search Head
• Other indexes assigned to the same role are visible and working as expected in Log Observer Connect.

Despite validating permissions, role configuration, and workload rules, the affected index remains unavailable in Log Observer Connect.

Investigation

The following investigation steps can be used to identify the root cause:

1. Role and Permissions Validation

   • Confirm the Log Observer Connect service role has read access to the affected index.
   • Verify the index is included in the role’s searchable indexes.
   • Run direct searches against the index using the service account to confirm data access.

2. Log Observer Connect Configuration Review

   • Verify a dedicated service account is configured for Log Observer Connect as outlined in the official documentation.
   • Confirm a workload rule limiting search duration is configured, if required by the deployment.
   • Validate that other indexes assigned to the same role appear correctly in the Log Connection configuration.

3. Index Visibility Comparison

   • Add an additional known-working index to the service role.
   • Confirm that this index appears in the Log Observer Connect index selection list.

4. Backend Index Definition Validation

   • Verify whether index definitions exist on both the Search Heads (SH) and Indexers (IDX).
   • Identify whether the affected index definition exists only on the Indexers and is missing from the Search Heads.

Resolution

The root cause is a missing index definition on the Search Heads. Log Observer Connect relies on Search Head metadata to enumerate available indexes. If an index definition exists only on the Indexers, the index does not appear in the Log Connection configuration and cannot be queried in Splunk Observability Cloud.

Resolution Steps:

• Open a Splunk Support case requesting synchronization of the affected index definition across both the Search Heads and Indexers.
• Include the index name(s) and confirmation that the index definition exists on the Indexers but is missing from the Search Heads.
• Coordinate the change during an approved maintenance window, if applicable.
• After the synchronization is completed by Support, verify that the index appears in the Log Observer Connect index selection list and is queryable in Splunk Observability Cloud.

Related Links

Splunk Log Observer Connect
Using Log Observer Connect with Cloud Platform