We saw that one input has stopped indexing exactly at midnight when starting a new month. So we have the correct data untill 28/02/2018 23:59:59 and after midnight no data is visible anymore.
The Splunk Forwarder is working correctly and is sending all the data from all other inputs without any issues. The forwarder is also not reporting any problems with indexing the inputs that has stopped working.
I tried restarting the forwarder, restarting the indexer (all in one Splunk Enterprise) and I alsready tried uninstalling the app on this server that holds this input (using the Splunk Deployment server).
The forwarder does recognize the new files in the input directory just fine but it seems like it is not indexed correctly as we cannot search the data.
How can I further troubleshoot what happened or is this a known bug in this version of Splunk?
**Splunk Enterprise:**
VERSION=6.6.3
BUILD=e21ee54bc796
PRODUCT=splunk
PLATFORM=Linux-x86_64
**Splunk Universal Forwarder:**
VERSION=6.6.3
BUILD=e21ee54bc796
PRODUCT=splunk
PLATFORM=Linux-x86_64
↧