Splunk stopped indexing on index="main"

[lana0203]

Hello guys,

I will first mention that I'm pretty new to Splunk, but I noticed that Splunk has stopped indexing and getting logs from my kali VM and desktop host whose logs go to index=main. Basically, Splunk logs are being indexed properly as well as other indexes, however the "main" index doesn't log since 2 days ago (08/11/21). 

I tried searching for errors in splunkd but I'm not as proficient so I hope you anybody here can help me understand what the problem is.

Thank you! 

[bhargavi]

Hi @lana0203 

1. Can you check if logs are being generated on your VM/desktop after 08/11/2021. If there are no logs being generated, then your index will not have any data.

2. Are you seeing in splunkd logs if the logs are being watched? .. you would find log line as 'Adding Watch on path "...  your log.

3. Is splunk running fine on your VM? You can try restarting splunkd on your VM and checked if logs are being pushed.