topic Re: Windows Universal Forwarder - "received event for unconfigured/disabled index" warning message in Getting Data In

Windows Universal Forwarder - "received event for unconfigured/disabled index" warning message

jstockamp — Mon, 28 Sep 2020 09:32:17 GMT

I'm trying to configure the Splunk Unviersal forwader on a windows box to forward windows event log messages to my splunk 4.2 indexer. I wanted to keep windows events in a separate index from my other linux logs, so I created a new index on the indexer for "windows_events" and made sure it was enabled. I then added "index = windows_events" to each of my sections in the inputs.conf file in "C:\Program Files\SplunkUniversalForwarder\etc\apps\MSICreated\local" on my forwarder.

I'm getting events into my windows_events index, but I'm also seeing this warning at the top of my search screen

received event for unconfigured/disabled index='"windows_events"' with source='source::WinEventLog:Security' host='host::DC001' sourcetype='sourcetype::WinEventLog:Security' (1 missing total)

Any idea how to clear this warning message?

Jeff

Re: Windows Universal Forwarder - "received event for unconfigured/disabled index" warning message

MarioM — Sun, 08 May 2011 09:39:56 GMT

how did you create your index?via the UI?via the indexes.conf?

do you have more than 1 indexer? if yes did you create the index on all of the indexer?

Re: Windows Universal Forwarder - "received event for unconfigured/disabled index" warning message

jstockamp — Mon, 09 May 2011 15:10:31 GMT

I had created the index via SplunkWeb manager. This issues seems to have resolved itself after restarting splunk about 3 times and waiting a few hours.