Help on indexation issue root cause

[jip31]

Hi

Is anybody can do send me an inventory of the root cause which can provoke an interruption of the Splunk indexation ?

Thanks

[santoshneelam]

@jip31 , use this link
https://conf.splunk.com/files/2019/slides/FN1570.pdf

I keep this handy for troubleshooting the indexing or queue issue. 

[gcusello]

Hi @jip31,

there could be many causes on  indexing block:

at first check if you have messages from Splunk: if indexing is blocked you should have a message and a first idea of the issue.

Then check if is blocked every indexing or only indexing of some data flows: if all indexing the problem should be on Indexer, if only some Data Flows the problem cluld be both on Indexer or source.

Then check if you reached the minimum disk space on the Indexer: this situation should be highlighted by a message.

Ciao.

Giuseppe