topic Re: Ask Help on Indexes in Getting Data In

Ask Help on Indexes

imzakaria — Sat, 15 Jan 2022 22:18:53 GMT

Hi Spelunker's!.

I'm receiving this message from Splunk

"Received event for unconfigured/disabled/deleted index=threathunting with source="source::[T1015] Accessibility Features" host="host::hdc-sec01-siem001" sourcetype="sourcetype::stash". So far received events from 1 missing index(es)"

Kindly advice.
Thank you.

Re: Ask Help on Indexes

gcusello — Sun, 16 Jan 2022 06:06:17 GMT

Hi @imzakaria,

the message means that you configured in your inpus the index threathunting that isn't present in your indexers or is disabled.

Check if the index is enabled and if the name is correct; then check the input.

Ciao.

Giuseppe

Re: Ask Help on Indexes

imzakaria — Mon, 17 Jan 2022 00:07:00 GMT

Thank you @gcusello for the input. We check on my end.