https://community.splunk.com/t5/Getting-Data-In/How-to-fix-an-error-quot-Received-event-for-unconfigured/m-p/272037#M52272 <P>Search peer xxxxxxxxxx has the following message: </P> <PRE><CODE>Received event for unconfigured/disabled/deleted index=wineventlog with source="source::WinEventLog:Security" host="host::clientxxxx" sourcetype="sourcetype::WinEventLog:Security". So far received events from 1 missing index(es).&nbsp;‎25‎/‎10‎/‎2016‎ ‎14‎:‎04‎:‎25 </CODE></PRE> <P>My input.conf</P> <PRE><CODE>[WinEventLog://Security] disabled=0 index=webservices_windows blacklist1=5156,4658,4672,5158,4648,4663,4776,4634,4656,5157 blacklist2 = EventCode="4624" Message="Account\sName:[\s\S]+-[\s\S]+Logon\sType\:[\s\t]+3[\s\S]+Account\sName:[\s\t]+[^\$]+\$" checkpointInterval=5 current_only=1 [install] state = enabled [tcpout] defaultGroup = ue-autolb-group useACK = true [tcpout:ue-autolb-group] server = 00.000.00.000:9991, 00.000.00.000:9991, 00.000.00.000:9991 autoLB = true </CODE></PRE> <P>please help deployment server correct same as indexers.</P> Tue, 25 Oct 2016 15:43:23 GMT maxruas 2016-10-25T15:43:23Z https://community.splunk.com/t5/Getting-Data-In/How-to-fix-an-error-quot-Received-event-for-unconfigured/m-p/272037#M52272 <P>Search peer xxxxxxxxxx has the following message: </P> <PRE><CODE>Received event for unconfigured/disabled/deleted index=wineventlog with source="source::WinEventLog:Security" host="host::clientxxxx" sourcetype="sourcetype::WinEventLog:Security". So far received events from 1 missing index(es).&nbsp;‎25‎/‎10‎/‎2016‎ ‎14‎:‎04‎:‎25 </CODE></PRE> <P>My input.conf</P> <PRE><CODE>[WinEventLog://Security] disabled=0 index=webservices_windows blacklist1=5156,4658,4672,5158,4648,4663,4776,4634,4656,5157 blacklist2 = EventCode="4624" Message="Account\sName:[\s\S]+-[\s\S]+Logon\sType\:[\s\t]+3[\s\S]+Account\sName:[\s\t]+[^\$]+\$" checkpointInterval=5 current_only=1 [install] state = enabled [tcpout] defaultGroup = ue-autolb-group useACK = true [tcpout:ue-autolb-group] server = 00.000.00.000:9991, 00.000.00.000:9991, 00.000.00.000:9991 autoLB = true </CODE></PRE> <P>please help deployment server correct same as indexers.</P> Tue, 25 Oct 2016 15:43:23 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-fix-an-error-quot-Received-event-for-unconfigured/m-p/272037#M52272 maxruas 2016-10-25T15:43:23Z https://community.splunk.com/t5/Getting-Data-In/How-to-fix-an-error-quot-Received-event-for-unconfigured/m-p/272038#M52273 <P>The above configurations should not be in your indexes.conf file. The first part should be in inputs and the second part outputs. You should also have an indexes.conf file which contains the settings for your index <EM>webservices_windows</EM>. If you have done all of this, where are all of these conf files residing?</P> Wed, 26 Oct 2016 00:04:20 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-fix-an-error-quot-Received-event-for-unconfigured/m-p/272038#M52273 lquinn 2016-10-26T00:04:20Z https://community.splunk.com/t5/Getting-Data-In/How-to-fix-an-error-quot-Received-event-for-unconfigured/m-p/272039#M52274 <P>splunk2@deployment_servername$ cat /opt/splunk/etc/deployment-apps/forward_webservices/default/inputs.conf<BR /> [WinEventLog://Security]<BR /> disabled=0<BR /> index=webservices_windows<BR /> blacklist1=5156,4658,4672,5158,4648,4663,4776,4634,4656,5157<BR /> blacklist2 = EventCode="4624" Message="Account\sName:[\s\S]+-[\s\S]+Logon\sType:[\s\t]+3[\s\S]+Account\sName:[\s\t]+[^\$]+\$"<BR /> checkpointInterval=5<BR /> current_only=1</P> Tue, 29 Sep 2020 11:34:52 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-fix-an-error-quot-Received-event-for-unconfigured/m-p/272039#M52274 maxruas 2020-09-29T11:34:52Z