Alerting

How to check and resolve why Splunk is not indexing data?

rangineniarunku
Explorer

I have noticed that the latest event in the my index in the PROD instance of Splunk has no events after 9:01: AM this morning, 3/23. The same index in the Sandbox is indexing properly and events are showing almost real-time.
Could you please let know how to check the error and what is causing this issue? Also are there any systems in place to alert us if data is not indexing correctly, or do we need to set up Splunk alerts for each index to get notified of these types of issues?

0 Karma

gjanders
SplunkTrust
SplunkTrust

This is a very open ended question, you could start with Troubleshoot the input process and the monitoring console overview . Either custom alerts or applications like Meta Woot! could assist with tracking which index received data and which point in time...

Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...