Getting Data In

Why has my Splunk indexer stopped indexing after adding license in 6.5.0?

Path Finder

I have a Splunk Enterprise indexer (v 6.5.0) that is forwarding Windows security events.

Everything was going smooth when I was using the free license.

However, after I added the Enterprise license (pre-6.5.0 license) and restarted the service, the indexer is not receiving events from all the universal forwarders.

The firewall shows that the connection is established between the universal forwarders and the indexer (port 9997).

May I know what happened?

0 Karma

Path Finder

Hi, did you try restarting the universal forwarder service on the remote servers?

0 Karma

Path Finder

Hi aosso,

Yes I did restart the universal forwarder service on all the universal forwarders.

The last event received was 4:17PM after I imported the license and restarted the service. However, I do not find anything amiss in splunkd.log.

0 Karma