Has anyone had issues with Splunk not indexing any new data from a particular index for a prolonged period of time when there have been updates on the data source?

[jgreen12]

Our Splunk instance stopped indexing data from a particular index over 72 hours ago. There have been many updates from the data source that should trigger new events, but the last event is from 3 days ago (instead of this morning, which is the last time there were updates to the data).

There are 3 sourcetypes for this index - none have been updated in this time frame. The sourcetypes use an API call to JIRA.

I see no error messages in the logs in regards to this.

Any idea on what could be causing the issue and how we can go about resolving it?

[danillopavan]

Please check if you dont need to add the command "crcSalt = " in your sourcetype "inputs.config" file. I had a similar issue, where my splunk instance was not being uploaded because the files content didnt have any change. This command allows the upload even without any change in the source content.