Alerting

How to check and resolve why Splunk is not indexing data?

rangineniarunku
Explorer

I have noticed that the latest event in the my index in the PROD instance of Splunk has no events after 9:01: AM this morning, 3/23. The same index in the Sandbox is indexing properly and events are showing almost real-time.
Could you please let know how to check the error and what is causing this issue? Also are there any systems in place to alert us if data is not indexing correctly, or do we need to set up Splunk alerts for each index to get notified of these types of issues?

0 Karma

gjanders
SplunkTrust
SplunkTrust

This is a very open ended question, you could start with Troubleshoot the input process and the monitoring console overview . Either custom alerts or applications like Meta Woot! could assist with tracking which index received data and which point in time...

Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...