Getting Data In

Why has my Splunk indexer stopped indexing after adding license in 6.5.0?

michaeltay
Path Finder

I have a Splunk Enterprise indexer (v 6.5.0) that is forwarding Windows security events.

Everything was going smooth when I was using the free license.

However, after I added the Enterprise license (pre-6.5.0 license) and restarted the service, the indexer is not receiving events from all the universal forwarders.

The firewall shows that the connection is established between the universal forwarders and the indexer (port 9997).

May I know what happened?

0 Karma

aosso
Path Finder

Hi, did you try restarting the universal forwarder service on the remote servers?

0 Karma

michaeltay
Path Finder

Hi aosso,

Yes I did restart the universal forwarder service on all the universal forwarders.

The last event received was 4:17PM after I imported the license and restarted the service. However, I do not find anything amiss in splunkd.log.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...