topic Re: Splunk is not logging data in Getting Data In

Splunk is not logging data

pratapa — Thu, 05 Dec 2019 06:01:47 GMT

User complained that Splunk is not logging data

Data being stopped logging after 1:40 PM on Tue Dec 3rd.

Please help me in resolving the problem.

Re: Splunk is not logging data

richgalloway — Thu, 05 Dec 2019 13:01:08 GMT

We have to know more about your Splunk environment to offer specific help, but there are some things you can check.
Are the forwarders still running?
Is the data source still producing events?
If the data comes from a monitored file, is the file still present and has permissions allowing Splunk to read it?
Did any network changes happen that might prevent the data from getting to the indexer(s)?
Are there any errors in splunkd.log that might indicate a problem getting data in?

Re: Splunk is not logging data

kartm2020 — Thu, 05 Dec 2019 13:01:42 GMT

Hi Pratapa,
Can you please provide the type of logs ?
Is it stopped from all the sources or Host or Sourcetype ?

Re: Splunk is not logging data

gcusello — Thu, 05 Dec 2019 13:06:58 GMT

Hi @pratapa,
there could be many reasons because your Splunk doesn't receive data, you should debug point by point all your architecture:

in the last day, there was any change in configuration (roles, grants, deployed TAs)?
another user (e.g. admin) can see all the data?
is there any block in firewall routes between Universal Forwarder and Splunk Server?
from that server, you're continuing to receive in the same period Splunk internal logs (index=_internal host=your_host)?
the target server created the new logs?

Then check the inputs.conf deployed to that server.

Ciao.
Giuseppe