Splunk isn't working like it used to. Why?

[AllenRed]

I have one Splunk server working with one client. Currently when I search for Splunk logs (in the GUI with the source= setting in the free text field), I don't see newly updated files. Previously Splunk worked very fast. I saw time stamps of files that were updated almost instantly. A couple days ago, my Splunk enterprise license expired. The free version should allow for ample indexing, right? I only have one client server.

For the messages in the GUI version of Splunk, I see:

"skipped indexing of internal audit event will keep dropping events until indexer congestion is remedied. Check disk space and other issues that may cause indexer to block"

What should I do about this message? Why won't the search results in Splunk be for the most recent files like they used to be?

[jayannah]

Yes, the splunk continue to index upto 500MB per day even after expiry.. But answer for the message you is described in this Q & A http://answers.splunk.com/answers/44552/indexing-congestion-consistenly-happening.html

[dolivasoh]

The free license only allows for 500MB/day of indexing. If you've been running on that for more than 3 days, your searching ability is probably disabled as your indexer is in violation.

As for "skipped indexing of internal audit event will keep dropping events until indexer congestion is remedied", it says to Check disk space and other issues that may cause indexer to block. so I would go and check to make sure you have enough disk space as indexing will halt at the configured level of free space.