Splunk UI not showing data for one host

[rdonnelly001]

Hi,

I am running splunk enterprise in which we have multiple hosts sending data using the universal forwarder.

I have one host which was displaying data fine on the UI however stopped randomly at 22:40.

Checking the physical server it is connected to the splunk host and forwarding data ( i can see it processing the files using the webpage admin)

The host is also receiving the data from the server (can see the info messages for metrics from the host) however when i search the host on the UI i see all data up till 22:40 and nothing after.

No configuration changes were made or anything.

This is only affecting 1 host out of many.

[jgbricker]

If restarting the splunk service on the client doesnt fix it. I recommend reinstalling the forwarder and sending the configuration back down via your deployer or manually depending in you setup. Honestly in my experience it it not worth the time isolating/troubleshooting a client.

[rdonnelly001]

i tried an upgrade which didn't work.

I guess next step is to wipe the install completely and then re-deploy the forwarder as said.