I am developing and app and everything worked fine for a while. I then tried to package everything under my app default directory including the input.conf: [tcp-ssl:xxxx] sourcetype = syslog [SSL] rootCA = /opt/splunk/etc/certs/cacert.pem serverCert = /opt/splunk/etc/certs/splunk.pem password = xxxxx I can see the packets coming in the port using tcpdump; so, Splunk is receiving network data but the idexing stopped; the data is diappearing. There are no licensing issues and I am stuck. No errors How do I debug this? ... View more