Getting Data In

Has anyone had issues with Splunk not indexing any new data from a particular index for a prolonged period of time when there have been updates on the data source?

jgreen12
New Member

Our Splunk instance stopped indexing data from a particular index over 72 hours ago. There have been many updates from the data source that should trigger new events, but the last event is from 3 days ago (instead of this morning, which is the last time there were updates to the data).

There are 3 sourcetypes for this index - none have been updated in this time frame. The sourcetypes use an API call to JIRA.

I see no error messages in the logs in regards to this.

Any idea on what could be causing the issue and how we can go about resolving it?

Tags (1)
0 Karma

danillopavan
Communicator

Please check if you dont need to add the command "crcSalt = " in your sourcetype "inputs.config" file. I had a similar issue, where my splunk instance was not being uploaded because the files content didnt have any change. This command allows the upload even without any change in the source content.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...