Getting Data In

Splunk not indexing data

a_dev
Engager

Hi,

recently our splunk instance has not been indexing our data. All licenses are OK and we are not exceeding our loads(we have other instances which are working with much higher loads).
At first some our data was being indexed, then nothing was. after a restart our data was being indexed again but a few hours later it stopped again and we have had nothing since.
We tried deleting old indexes and having multiple small log files rather than one large one yet nothing works and we are all out of ideas.

Has anybody any ideas?

Thanks

Tags (1)

jbsplunk
Splunk Employee
Splunk Employee

Have you tried to search something like

'index=*' and removing the time constraints, then replacing them with with the 'All Time - Real Time' Drop Down from the all time menu? This will show you all logs presently being indexed by splunk. Perhaps the issue is that your data isn't being indexed in the manner you expect, or something is failing with timestamp extraction causing it not to be returned by your search string.

0 Karma

jbsplunk
Splunk Employee
Splunk Employee

What are you seeing in splunkd.log under $SPLUNK_HOME/var/log/splunk/?

0 Karma

a_dev
Engager

yes i have tried that. no data seems to be indexed

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...