Getting Data In
Highlighted

Why has Splunk stopped indexing my files?

Splunk Employee
Splunk Employee

Customer reported that a standalone Splunk Indexer had stopped indexing any monitored files.
They also noticed that :

  • Splunks _internal index was no longer been written to.
  • The Splunk GUI was available and "splunk status" showed splunk was running
  • Splunks log files in $SPLUNK_HOME/var/log/splunk were being written to corectly
Highlighted

Re: Why has Splunk stopped indexing my files?

Splunk Employee
Splunk Employee

In splunkd.log the following error was observered

WARN  TailingProcessor - Called run() on disabled instance.  Will not run.

This message appears when disabled=true is set in a global/default stanza in inputs.conf
In $SPLUNK_HOME/etc/system/local/inputs.conf it was found that the following stanza had been mistakenly set

[default]
disabled = 1
index = test
sourcetype = testing

When this stanza was removed and Splunk was restarted, indexing resumed correctly

Highlighted

Re: Why has Splunk stopped indexing my files?

Influencer

Don't forget to mark as answered 🙂