topic How to check when the index is disabled/enabled in Splunk Enterprise

How to check when the index is disabled/enabled

sajeshpp — Wed, 26 Jul 2017 14:31:25 GMT

We are seeing once of our index is disabled.
Is there any way to find when the index was disabled (date and time)?
Is this info logged in any log files ?

Re: How to check when the index is disabled/enabled

niketn — Wed, 26 Jul 2017 16:29:34 GMT

@sajeshpp, you can get this from Splunk's _audit index. Add the index name which has been disabled to the following query:

index="_audit" action=disable object="<YourDisabledIndexName>"
 | table object action user timestamp _raw _time

Re: How to check when the index is disabled/enabled

woodcock — Wed, 26 Jul 2017 17:15:13 GMT

You will know if you are getting events for that index, believe me!

On all Search Heads that are peered to indexers in the Messages area you will see messages like:

Received event for unconfigured/disabled/deleted index='lost_index' with source='source::/tmp/test' host='host::localhost.localdomain' sourcetype='sourcetype::anything' (1 missing total)

You can also search _internal for splunkd.log (/opt/splunk/var/log/splunk/splunkd.log) for events like this:

05-22-2017 17:30:43.276 +0200 WARN  IndexProcessor - received event for unconfigured/disabled/deleted index='lost_index' with source='source::/tmp/test' host='host::localhost.localdomain' sourcetype='sourcetype::anything' (1 missing total)

Re: How to check when the index is disabled/enabled

sajeshpp — Thu, 27 Jul 2017 04:41:22 GMT

thanks.. this worked out for me

Re: How to check when the index is disabled/enabled

sajeshpp — Thu, 27 Jul 2017 04:47:50 GMT

thanks for your response 🙂
yes. it shows the messages. But it won't tell you when the index was disabled.

We are not using/monitoring this server regularly as it is part of poc/testing activity and also logs are not pushed regularly to the index. Hence it will be difficult to find when was index disabled by whom.

Re: How to check when the index is disabled/enabled

niketn — Thu, 27 Jul 2017 07:11:21 GMT

Great... Cheers!!!

Re: How to check when the index is disabled/enabled

woodcock — Thu, 27 Jul 2017 18:48:37 GMT

Search in _internal for the log that I indicated. When it first started happening is roughly when it was disabled.