Getting Data In

Splunk Free Edition stopped indexing after set-up

sploited
New Member

I've tried browsing around previous topics but couldn't find anything that worked for my particular situation. I have a very simple test setup with a Universal Forwarder, a Debian 9 machine running the free edition of Splunk Enterprise, and another non-Splunk box. My goal was to simulate log forwarding from the workstation running the Universal Forwarder to the Splunk box to my non-Splunk box. I was indexing things up to 3 hours ago while troubleshooting why logs weren't being forwarded to my non-Splunk server. Eventually, I was able to get this data forwarded successfully to my non-Splunk server but then I noticed it stopped indexing on the Splunk server. No errors.

My Splunk servers outputs.conf:
[tcpout]
defaultGroup = default-autolb-group

[tcpout:default-autolb-group]
server = 10.X.1.99:514
sendCookedData = false
indexAndForward=true
[tcpout-server://10.X.1.99:514]

My Splunk servers inputs.conf; listening on 9997:
[default]
host = splunk


My Universal Forwarders outputs.conf:
[tcpout]
defaultGroup = default-autolb-group

[tcpout:default-autolb-group]
server = 10.X.1.181:9997
autoLB = true

My Universal Forwarders inputs.conf (SOC workstation):
[default]
host = SOC-6

Monitored Files:
$SPLUNK_HOME/etc/splunk.version
/var/log/auth.log
/var/log/syslog

It's supposed to be a very basic setup. Like I said, I'm receiving logs on the non-Splunk box which was the main goal but I can't leave it partial with the Indexer not indexing. If you require further information feel free to request it. Thanks

0 Karma

MuS
SplunkTrust
SplunkTrust

Did you check the free disk space on the indexer? The default value is 5000 Mb , see the docs http://docs.splunk.com/Documentation/Splunk/latest/Admin/Serverconf if the the free disk space is lower Splunk stops indexing.

cheers, MuS

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...