Splunk is not logging data

[pratapa]

User complained that Splunk is not logging data

Data being stopped logging after 1:40 PM on Tue Dec 3rd.

Please help me in resolving the problem.

[gcusello]

Hi @pratapa,
there could be many reasons because your Splunk doesn't receive data, you should debug point by point all your architecture:

• in the last day, there was any change in configuration (roles, grants, deployed TAs)?
• another user (e.g. admin) can see all the data?
• is there any block in firewall routes between Universal Forwarder and Splunk Server?
• from that server, you're continuing to receive in the same period Splunk internal logs (index=_internal host=your_host)?
• the target server created the new logs?

Then check the inputs.conf deployed to that server.

Ciao.
Giuseppe

[kartm2020]

Hi Pratapa,
Can you please provide the type of logs ?
Is it stopped from all the sources or Host or Sourcetype ?

[richgalloway]

We have to know more about your Splunk environment to offer specific help, but there are some things you can check.
Are the forwarders still running?
Is the data source still producing events?
If the data comes from a monitored file, is the file still present and has permissions allowing Splunk to read it?
Did any network changes happen that might prevent the data from getting to the indexer(s)?
Are there any errors in splunkd.log that might indicate a problem getting data in?