Issue:
Monitored file suddenly stops being monitored/indexing.
Root cause:
File growth rate is higher than indexing or forwarding rate. (maxKBps value is too low)
[thruput]
maxKBps = 384
maxKBps = 384
Solution:
Change the maxKBps value to a higher value(increase the maxKBps value upto 500) & Restart the Splunk.
[thruput]
maxKBps = 500