Splunk Stops Indexing

[digital4rensics]

I've run through the setup twice and both times I have now run in to this issue. Haven't done in-depth investigation yet.

After running for a few hours, splunk seems to stop indexing any new events. Looking to determine if this is a splunk/logger or a wef issue.

In both cases, it looks as though the ports are still opening/listening, and splunk is still accessible via the web app on logger.

[clong]

Thanks for the report! Are all indexes affected or just specific ones?

[digital4rensics]

Sure thing @clong - digging on this more - might be mostly my error.

Looking at the indexes breakdown, seems only the main index that appears to have stopped incrementing in # of events indexed. Is that only used initially?

[clong]

I don't believe the main index is actually used for anything. It's odd that events would be sent there unless the indexes hadn't been configured by the time logs started sending to Splunk. I'll close this out for now, but feel free to re-open it if you find this issue occurring in other indexes! Appreciate the feedback!