Splunk stop indexing after restart

beyourwish — Fri, 17 Aug 2012 23:21:29 GMT

Hi,

After I restart splunk, Log files doesn't get indexed.

Any idea how can I overcome this issue?

I tried,

splunk restart

splunk stop splunkd -> start again

on splunk-server:8089/services/admin/inputstatus/

that file status : batch processing

Thanks

Re: Splunk stop indexing after restart

adamw — Sun, 09 Sep 2012 22:12:49 GMT

Splunk takes a little while to spin up after a restart, how long are you waiting for these logs to show up after a restart?

Also depending on how you have the input set up, you could potentially speed up the process.

If you have
[monitor:/var/log/*]

Splunk will (on restart) iterate through the entire /var/log/ directory, listing all files in the directory and all subdirectories, then it will begin traversing down a directory level and on and on until it has finished. Then it will start indexing the files.

topic Splunk stop indexing after restart in Getting Data In

Splunk stop indexing after restart

Re: Splunk stop indexing after restart