Getting Data In

How to troubleshoot why Splunk suddently stopped indexing logs after 1-2 months?

kkomar
New Member

I have splunk in domain mode set to look through 2 inputs over UNC path that are IIS logs. I have the inputs the same as I did when I originally installed it. It worked great for about 1-2 months then just stopped cold. It see the files in the inputs but the index is still at 0. I've since reinstalled Splunk in desperation which is why it's at 0 now, but before it just stopped indexing, right in it's tracks. What am I doing wrong?

Tags (2)
0 Karma

lguinn2
Legend

Were you using the trial license? After 50 days, it reverts to a free license. And both of those licenses (trial and free) have a 500MB per day limit. Have you exceeded the license limit? Go to Settings -> Licensing to see if there are errors.

Also, are there any error messages in the splunkd.log file? You will find it in $SLPLUNK_HOME/varlog/splunk

0 Karma

newbie2tech
Communicator

Has anything changed with the files around the time it stopped working? Check if the first few lines of the file is same everyday in which case splunk would assume nothing new is written and it wouldn't ingest[read up about crcSalt]. Also what do you see in your splunkd logs?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...