Getting Data In

Why has my Splunk indexer stopped indexing after adding license in 6.5.0?

michaeltay
Path Finder

I have a Splunk Enterprise indexer (v 6.5.0) that is forwarding Windows security events.

Everything was going smooth when I was using the free license.

However, after I added the Enterprise license (pre-6.5.0 license) and restarted the service, the indexer is not receiving events from all the universal forwarders.

The firewall shows that the connection is established between the universal forwarders and the indexer (port 9997).

May I know what happened?

0 Karma

aosso
Path Finder

Hi, did you try restarting the universal forwarder service on the remote servers?

0 Karma

michaeltay
Path Finder

Hi aosso,

Yes I did restart the universal forwarder service on all the universal forwarders.

The last event received was 4:17PM after I imported the license and restarted the service. However, I do not find anything amiss in splunkd.log.

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...