Customer reported that a standalone Splunk Indexer had stopped indexing any monitored files.
They also noticed that :
In splunkd.log the following error was observered
WARN TailingProcessor - Called run() on disabled instance. Will not run.
This message appears when disabled=true is set in a global/default stanza in inputs.conf
In $SPLUNK_HOME/etc/system/local/inputs.conf it was found that the following stanza had been mistakenly set
disabled = 1
index = test
sourcetype = testing
When this stanza was removed and Splunk was restarted, indexing resumed correctly
Don't forget to mark as answered 🙂