Why has Splunk stopped indexing my files?

[dshakespeare_sp]

Customer reported that a standalone Splunk Indexer had stopped indexing any monitored files.
They also noticed that :

• Splunks _internal index was no longer been written to.
• The Splunk GUI was available and "splunk status" showed splunk was running
• Splunks log files in $SPLUNK_HOME/var/log/splunk were being written to corectly

[dshakespeare_sp]

In splunkd.log the following error was observered

WARN  TailingProcessor - Called run() on disabled instance.  Will not run.

This message appears when disabled=true is set in a global/default stanza in inputs.conf
In $SPLUNK_HOME/etc/system/local/inputs.conf it was found that the following stanza had been mistakenly set

[default]
disabled = 1
index = test
sourcetype = testing

When this stanza was removed and Splunk was restarted, indexing resumed correctly

[jplumsdaine22]

Don't forget to mark as answered 🙂