Getting Data In

Why has my Splunk indexer stopped indexing after adding license in 6.5.0?

michaeltay
Path Finder

I have a Splunk Enterprise indexer (v 6.5.0) that is forwarding Windows security events.

Everything was going smooth when I was using the free license.

However, after I added the Enterprise license (pre-6.5.0 license) and restarted the service, the indexer is not receiving events from all the universal forwarders.

The firewall shows that the connection is established between the universal forwarders and the indexer (port 9997).

May I know what happened?

0 Karma

aosso
Path Finder

Hi, did you try restarting the universal forwarder service on the remote servers?

0 Karma

michaeltay
Path Finder

Hi aosso,

Yes I did restart the universal forwarder service on all the universal forwarders.

The last event received was 4:17PM after I imported the license and restarted the service. However, I do not find anything amiss in splunkd.log.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...