Getting Data In

Why has Splunk stopped indexing my files?

dshakespeare_sp
Splunk Employee
Splunk Employee

Customer reported that a standalone Splunk Indexer had stopped indexing any monitored files.
They also noticed that :

  • Splunks _internal index was no longer been written to.
  • The Splunk GUI was available and "splunk status" showed splunk was running
  • Splunks log files in $SPLUNK_HOME/var/log/splunk were being written to corectly

dshakespeare_sp
Splunk Employee
Splunk Employee

In splunkd.log the following error was observered

WARN  TailingProcessor - Called run() on disabled instance.  Will not run.

This message appears when disabled=true is set in a global/default stanza in inputs.conf
In $SPLUNK_HOME/etc/system/local/inputs.conf it was found that the following stanza had been mistakenly set

[default]
disabled = 1
index = test
sourcetype = testing

When this stanza was removed and Splunk was restarted, indexing resumed correctly

jplumsdaine22
Influencer

Don't forget to mark as answered 🙂

Get Updates on the Splunk Community!

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...