https://community.splunk.com/t5/Getting-Data-In/Splunk-Issue/m-p/95019#M19802 <P>Well, I guess I would check for a crash log and see if there was any unusual activity (CPU, disk, memory) according to any data you gathered, as well as the splunk internal logs files. Those are in $SPLUNK_HOME/var/log/splunk, but also indexed into the _internal index.</P> Fri, 16 Mar 2012 18:39:10 GMT gkanapathy 2012-03-16T18:39:10Z https://community.splunk.com/t5/Getting-Data-In/Splunk-Issue/m-p/95018#M19801 <P>Good morning, </P> <P>Still VERY new to Splunk here. But I had a issue I was looking for input on where to start with troubleshooting. </P> <P>Our company has an index splunk service die somepoint yesterday. I started it again with ./splunk start and it went into a fsck mode and was doing that for roughly an hour then worked. This mornming A different indexer has the same issue. </P> <P>Any idea what could be happening? Where I would start troubleshooting something like that?</P> Fri, 16 Mar 2012 17:43:42 GMT https://community.splunk.com/t5/Getting-Data-In/Splunk-Issue/m-p/95018#M19801 daniel333 2012-03-16T17:43:42Z https://community.splunk.com/t5/Getting-Data-In/Splunk-Issue/m-p/95019#M19802 <P>Well, I guess I would check for a crash log and see if there was any unusual activity (CPU, disk, memory) according to any data you gathered, as well as the splunk internal logs files. Those are in $SPLUNK_HOME/var/log/splunk, but also indexed into the _internal index.</P> Fri, 16 Mar 2012 18:39:10 GMT https://community.splunk.com/t5/Getting-Data-In/Splunk-Issue/m-p/95019#M19802 gkanapathy 2012-03-16T18:39:10Z