All of a sudden _internal logs from HF stopped coming to indexers after a splunkd restart. But i see _audit logs making it to indexers. I see splunkd.log on HF is growing. There is no change in inputs.conf or outputs.conf before restart. What could be the reason?
↧