Getting Data In

Splunk Free Edition stopped indexing after set-up

sploited
New Member

I've tried browsing around previous topics but couldn't find anything that worked for my particular situation. I have a very simple test setup with a Universal Forwarder, a Debian 9 machine running the free edition of Splunk Enterprise, and another non-Splunk box. My goal was to simulate log forwarding from the workstation running the Universal Forwarder to the Splunk box to my non-Splunk box. I was indexing things up to 3 hours ago while troubleshooting why logs weren't being forwarded to my non-Splunk server. Eventually, I was able to get this data forwarded successfully to my non-Splunk server but then I noticed it stopped indexing on the Splunk server. No errors.

My Splunk servers outputs.conf:
[tcpout]
defaultGroup = default-autolb-group

[tcpout:default-autolb-group]
server = 10.X.1.99:514
sendCookedData = false
indexAndForward=true
[tcpout-server://10.X.1.99:514]

My Splunk servers inputs.conf; listening on 9997:
[default]
host = splunk


My Universal Forwarders outputs.conf:
[tcpout]
defaultGroup = default-autolb-group

[tcpout:default-autolb-group]
server = 10.X.1.181:9997
autoLB = true

My Universal Forwarders inputs.conf (SOC workstation):
[default]
host = SOC-6

Monitored Files:
$SPLUNK_HOME/etc/splunk.version
/var/log/auth.log
/var/log/syslog

It's supposed to be a very basic setup. Like I said, I'm receiving logs on the non-Splunk box which was the main goal but I can't leave it partial with the Indexer not indexing. If you require further information feel free to request it. Thanks

0 Karma

MuS
SplunkTrust
SplunkTrust

Did you check the free disk space on the indexer? The default value is 5000 Mb , see the docs http://docs.splunk.com/Documentation/Splunk/latest/Admin/Serverconf if the the free disk space is lower Splunk stops indexing.

cheers, MuS

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Think Like an Architect: Introducing the Splunk Certified Cybersecurity Defense ...

In cybersecurity, defenders respond to threats. Architects design the systems that stop them.    As ...

Index This | What has goals but no motivation?

June 2026 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Deep Dive: Accelerate threat investigation with Splunk’s AI Assistant in Security

AI is one of the biggest topics in the market today, and for security teams, its value goes far beyond the ...