How to troubleshoot why Splunk suddently stopped indexing logs after 1-2 months?

[kkomar]

I have splunk in domain mode set to look through 2 inputs over UNC path that are IIS logs. I have the inputs the same as I did when I originally installed it. It worked great for about 1-2 months then just stopped cold. It see the files in the inputs but the index is still at 0. I've since reinstalled Splunk in desperation which is why it's at 0 now, but before it just stopped indexing, right in it's tracks. What am I doing wrong?

[lguinn2]

Were you using the trial license? After 50 days, it reverts to a free license. And both of those licenses (trial and free) have a 500MB per day limit. Have you exceeded the license limit? Go to Settings -> Licensing to see if there are errors.

Also, are there any error messages in the splunkd.log file? You will find it in $SLPLUNK_HOME/varlog/splunk

[newbie2tech]

Has anything changed with the files around the time it stopped working? Check if the first few lines of the file is same everyday in which case splunk would assume nothing new is written and it wouldn't ingest[read up about crcSalt]. Also what do you see in your splunkd logs?