topic Search peer XXXBIXX has the following message: Received event for unconfigured/disabled/deleted index in Splunk Enterprise

Search peer XXXBIXX has the following message: Received event for unconfigured/disabled/deleted index

90522prakash — Mon, 28 Feb 2022 05:43:03 GMT

Hi,

Below warning message is showing in our Search head cluster.

Search peer XXXBIXX has the following message: Received event for unconfigured/disabled/deleted
index=A with source="B" host="host::C" sourcetype="D". So far received events from 2 missing index(es).

I have verified "A" Index is not exists in our indexers and from the host no internal logs received except license_usage.log.

how to figured out where the inputs configured for this host host="host::C" ?

Re: Search peer XXXBIXX has the following message: Received event for unconfigured/disabled/deleted index

gcusello — Mon, 28 Feb 2022 07:37:58 GMT

Hi @90522prakash,

the message you have means that in your inputs.conf on those hosts there's an input stanza in inputs.conf that is configured to send logs to Index="A".

You can check running from CLI on those forwarders the btool command

/opt/splunk/bin/splunk cmd btool inputs list --debug | grep "index"

so check if there's an index=A.

Ciao.

Giuseppe