Splunk stop indexing after restart

[beyourwish]

Hi,

After I restart splunk, Log files doesn't get indexed.

Any idea how can I overcome this issue?

I tried,

splunk restart

splunk stop splunkd -> start again

on splunk-server:8089/services/admin/inputstatus/

that file status : batch processing

Thanks

[adamw]

Splunk takes a little while to spin up after a restart, how long are you waiting for these logs to show up after a restart?

Also depending on how you have the input set up, you could potentially speed up the process.

If you have
[monitor:/var/log/*]

Splunk will (on restart) iterate through the entire /var/log/ directory, listing all files in the directory and all subdirectories, then it will begin traversing down a directory level and on and on until it has finished. Then it will start indexing the files.