Indexers outage - What can I do to troubleshoot?

[GaetanVP]

Hello Splunkers, 

I am facing a problem with my indexers that are not able to index anymore. Neither the data forwarder to those indexers, neither the internal Splunk logs... I even tried to index data (simple txt file) directly from the indexer GUI, I do not get any error but my selected indexe will not be filled/updated.

Any clue what I can do to troubleshoot ? There is nothing in splunkd.log file, what other logs should I check?

Regards,
GaetanVP

[gcusello]

Hi @GaetanVP,

did you checked if you have sufficient disk space on indexers? usually this is the reason for stop internal indexing.

If you have sufficient disk space and resources, open a ticket to Splunk Support.

Ciao.

Giuseppe

[GaetanVP]

Hello @gcusello, sorry for the late reply,

Just for information the problem was linked to a bad outputs.conf I put on my Indexers. As you know, having issues with outgoing traffic would impact the data flow in a way that tcpout queue would fill up, that was the case.

Thanks,

GaetanVP