topic Re: Help on indexation issue root cause in Getting Data In

Help on indexation issue root cause

jip31 — Tue, 11 Jul 2023 07:11:15 GMT

Is anybody can do send me an inventory of the root cause which can provoke an interruption of the Splunk indexation ?

Thanks

Re: Help on indexation issue root cause

gcusello — Tue, 11 Jul 2023 07:25:37 GMT

there could be many causes on indexing block:

at first check if you have messages from Splunk: if indexing is blocked you should have a message and a first idea of the issue.

Then check if is blocked every indexing or only indexing of some data flows: if all indexing the problem should be on Indexer, if only some Data Flows the problem cluld be both on Indexer or source.

Then check if you reached the minimum disk space on the Indexer: this situation should be highlighted by a message.

Ciao.

Giuseppe

Re: Help on indexation issue root cause

santoshneelam — Tue, 11 Jul 2023 07:57:27 GMT

@jip31 , use this link
https://conf.splunk.com/files/2019/slides/FN1570.pdf

I keep this handy for troubleshooting the indexing or queue issue.