topic Re: received event for unconfigured/disabled index=_audit in Splunk Enterprise

received event for unconfigured/disabled index=_audit

heterodyned — Thu, 10 Mar 2011 10:34:16 GMT

Currently, I have enabled splunk forwarder on a particular windows box with SSL encryption to the indexer. ( Although this may not be actually the source of the issue)

I am receiving events for unconfigured/disabled index='_audit' on the forwader for some reason. I did verify that all the indexes in the forwarder are enabled, and the same holds true for the receiver

Any idea what could be the source of the issue?

Re: received event for unconfigured/disabled index=_audit

heterodyned — Thu, 10 Mar 2011 13:30:27 GMT

I could fix this issue, the windows forwarder was actually configured as LightForwarder and was still operating in LightForwarder Mode, ( this was done by someone previously) and at the sametime I was using the SplunkWebUI for this particular server, which was causing these events.

Solution: I disabled splunk-light forwarder and enabled forwarder mode, the issue got resolved

Re: received event for unconfigured/disabled index=_audit

jbsplunk — Thu, 24 Mar 2011 23:30:11 GMT

This is a defect in 4.1.x, the message happens when you restart a LWF. I have been able to replicate the issue. It has been reported to support and is being investigated by engineering. This has been added to the known issues document, see SPL-37337:

http://www.splunk.com/base/Documentation/4.1.7/ReleaseNotes/Knownissues