I am monitoring files in a directory which Splunk pulls into an index when new files show up in the directory. We ran the script which updated the files in the directory, but the index only has old data - no new data is being pulled into the index. This has been working for weeks, but quit working when our /opt directory filled up. We shutdown Splunk, resolved the space issue with /opt, and restarted Splunk. Since the restart, no new data.
How can I troubleshoot this issue to determine why the new data is not being pulled into the index?
↧