How to repair Data input index to normal state

[KJ10]

How I can repair Data input index to normal state.
I created Data input as per my Technical Add on , for some reason I changed my index in inputs.conf to new index, which apparently doesnt work in Splunk 9.3 though I created new index from UI. Later I changed my index to original but somehow that Data input stuck and never executing at all.
I tried reinstalling my TA app and splunk restart multiple time but no luck and no error in spulnkd.log. Same scenario happened at client end.
Can anybody please guide me for this repair or what can be RCA though we reverted all inputs to normal.

[gcusello]

Hi @KJ10 ,

could you share your inputs.conf file?

anyway, in general, the option index=<your_index> in inputs.conf, if the index is really existent, shouldn't have any issue.

Didi you checked if the index is really existent and if you gave the correct grants to it?

Anyway, if you restore the original index name in inputs.conf, and restart Splunk on the Forwarder, logs should arrive to the original index; did you restarted the UF after restored the original index?

Are you using a Deployment Server to deploy configurations on UF or did you manually modified them?

Ciao.

Giuseppe