topic Splunk not indexing data in Getting Data In

Splunk not indexing data

a_dev — Mon, 20 Jun 2011 14:10:06 GMT

Hi,

recently our splunk instance has not been indexing our data. All licenses are OK and we are not exceeding our loads(we have other instances which are working with much higher loads).
At first some our data was being indexed, then nothing was. after a restart our data was being indexed again but a few hours later it stopped again and we have had nothing since.
We tried deleting old indexes and having multiple small log files rather than one large one yet nothing works and we are all out of ideas.

Has anybody any ideas?

Thanks

Re: Splunk not indexing data

jbsplunk — Mon, 20 Jun 2011 18:54:15 GMT

Have you tried to search something like

'index=*' and removing the time constraints, then replacing them with with the 'All Time - Real Time' Drop Down from the all time menu? This will show you all logs presently being indexed by splunk. Perhaps the issue is that your data isn't being indexed in the manner you expect, or something is failing with timestamp extraction causing it not to be returned by your search string.

Re: Splunk not indexing data

a_dev — Tue, 21 Jun 2011 08:06:21 GMT

yes i have tried that. no data seems to be indexed

Re: Splunk not indexing data

jbsplunk — Tue, 21 Jun 2011 15:30:47 GMT

What are you seeing in splunkd.log under $SPLUNK_HOME/var/log/splunk/?