Why has my Splunk indexer stopped indexing after adding license in 6.5.0?

[michaeltay]

I have a Splunk Enterprise indexer (v 6.5.0) that is forwarding Windows security events.

Everything was going smooth when I was using the free license.

However, after I added the Enterprise license (pre-6.5.0 license) and restarted the service, the indexer is not receiving events from all the universal forwarders.

The firewall shows that the connection is established between the universal forwarders and the indexer (port 9997).

May I know what happened?

[aosso]

Hi, did you try restarting the universal forwarder service on the remote servers?

[michaeltay]

Hi aosso,

Yes I did restart the universal forwarder service on all the universal forwarders.

The last event received was 4:17PM after I imported the license and restarted the service. However, I do not find anything amiss in splunkd.log.