Not seeing data after upgrading Splunk from 9.0.4 to 9.2.2

Applicability

Description

Not seeing data after upgrade from 9.0.4 to 9.2.2 

Investigation

The steps had been followed in the documentation below in the section.

Upgrade pre-9.2 deployment servers

Indexers require new internal deployment server indexes

To avoid problems, create these new internal deployment server indexes in indexes.conf on any pre-9.2 indexers in your environment:

[_dsphonehome]
[_dsclient]
[_dsappevent]

Resolution

These stanzas were added to outputs.conf and indexes.conf:

Indexers require new internal deployment server indexes

Create these new indexers in the indexer cluster before upgrading.

[_dsphonehome]
[_dsclient]
[_dsappevent]

The Deployment Server data was not appearing in the Forwarder Management UI following the upgrade.

Edit outputs.conf on the DS before upgrading:

[indexAndForward]
index = true
selectiveIndexing = true

Then you upgraded Splunk from version 9.0.4 to version 9.2.2 and saw that after upgrading you could not receive any data,  so commented out the following:

The lines that were commented out are below.

[splunk@uvigrz5011 local]$ cat outputs.conf
#[indexAndForward]0
#index = true
#selectiveIndexing = true[splunk@uvigrz5011 local]$ pwd
/opt/splunk/etc/system/local

After restarting Splunk, data was received again.