https://community.splunk.com/t5/Getting-Data-In/Splunk-Suddenly-Stops-Indexing/m-p/101958#M21389 <P>Problem seems to be related to Index. I was using a new Index which I had made, when I just tried using the main Index it started straight away.</P> <P>Is this a limitation of the free version?</P> Tue, 27 Mar 2012 12:53:37 GMT matthewcanty 2012-03-27T12:53:37Z https://community.splunk.com/t5/Getting-Data-In/Splunk-Suddenly-Stops-Indexing/m-p/101957#M21388 <P>I'm new to Splunk - as in this morning - but have been shown around it a few times. I've just downloaded the free version and installed everything fine. I have setup an indexer, and started adding data from a folder location. </P> <P>The summary shows all of the files in the directory and has found the two sources which I wanted to see which is great.</P> <P>Under Source Types I have a source <CODE>DataNormalisation</CODE> and its Last Update time is "Tue Mar 27 09:32:33 2012". When I click it and go for Last 7 Days the last message is from the 23rd. If I look in the file the last message is today - because the service is running now and logging now. </P> <P>What am I doing wrong?</P> <P>Head/Tail issue?</P> <P>Please see the following three images in order as a proof...</P> <P><A href="https://lh5.googleusercontent.com/-5sBE6oDMpDo/T3Gt_tBxxcI/AAAAAAAACC8/WqwnIzK9k6Y/s912/page1.jpg">Page 1</A> | <A href="https://lh6.googleusercontent.com/-INOa7xAq13s/T3Gt_oYWLqI/AAAAAAAACC0/cSf_HXqjLgw/s912/page2.jpg">Page 2</A> | <A href="https://lh4.googleusercontent.com/-kHXqyiQwCqY/T3Gt_ixcgHI/AAAAAAAACC4/s0-HGxuo4bc/s912/page3.jpg">Page 3</A></P> <P>See on Page 2 the last message is on 26th... </P> Tue, 27 Mar 2012 10:19:03 GMT https://community.splunk.com/t5/Getting-Data-In/Splunk-Suddenly-Stops-Indexing/m-p/101957#M21388 matthewcanty 2012-03-27T10:19:03Z https://community.splunk.com/t5/Getting-Data-In/Splunk-Suddenly-Stops-Indexing/m-p/101958#M21389 <P>Problem seems to be related to Index. I was using a new Index which I had made, when I just tried using the main Index it started straight away.</P> <P>Is this a limitation of the free version?</P> Tue, 27 Mar 2012 12:53:37 GMT https://community.splunk.com/t5/Getting-Data-In/Splunk-Suddenly-Stops-Indexing/m-p/101958#M21389 matthewcanty 2012-03-27T12:53:37Z https://community.splunk.com/t5/Getting-Data-In/Splunk-Suddenly-Stops-Indexing/m-p/101959#M21390 <P>By default Splunk will search and the search app references the main index. If you search <CODE>index=YOURINDEX</CODE> it should return all your events</P> Tue, 27 Mar 2012 12:59:04 GMT https://community.splunk.com/t5/Getting-Data-In/Splunk-Suddenly-Stops-Indexing/m-p/101959#M21390 Drainy 2012-03-27T12:59:04Z