topic Re: Why am I getting error "Received event for unconfigured/disabled/deleted index="wineventlog"" when the index does exist? in Getting Data In

Why am I getting error "Received event for unconfigured/disabled/deleted index="wineventlog"" when the index does exist?

Epicism1 — Tue, 09 Feb 2016 21:18:39 GMT

Hello,

I am trying to log the Sysmon/Operational Windows event logs via the Sysmon TA app:

[WinEventLog://Microsoft-Windows-Sysmon/Operational]
disabled = false
renderXml = true
index=wineventlog

But when I push the app to the Universal Forwarders on my Windows boxes, I am receiving the error:

Received event for unconfigured/disabled/deleted index="wineventlog" with source="source::WinEventLog:Microsoft-Windows-Sysmon/Operational" host="host::XX" sourcetype="sourcetype::XmlWinEventLog:Microsoft-Windows-Sysmon/Operational". So far received events from 1 missing index(es).

The challenge is that the index does exist and is enabled:

It was originally created by the Windows TA app, so I deleted it, recreated it, put it in indexes.conf, but nothing. I cannot see the issue.

Any help would be appreciated.

Re: Why am I getting error "Received event for unconfigured/disabled/deleted index="wineventlog"" when the index does exist?

s2_splunk — Tue, 09 Feb 2016 23:37:15 GMT

Can you run sudo ./splunk cmd btool indexes list --debug | grep -A 10 "\[wineventlog" on your indexer and share the output, please?

Re: Why am I getting error "Received event for unconfigured/disabled/deleted index="wineventlog"" when the index does exist?

Epicism1 — Wed, 10 Feb 2016 00:23:50 GMT

/opt/splunk/etc/system/local/indexes.conf                    [wineventlog]
/opt/splunk/etc/system/default/indexes.conf                  assureUTF8 = false
/opt/splunk/etc/system/default/indexes.conf                  bucketRebuildMemoryHint = auto
/opt/splunk/etc/system/local/indexes.conf                    coldPath = $SPLUNK_DB/wineventlog/colddb
/opt/splunk/etc/system/default/indexes.conf                  coldPath.maxDataSizeMB = 0
/opt/splunk/etc/system/default/indexes.conf                  coldToFrozenDir =
/opt/splunk/etc/system/default/indexes.conf                  coldToFrozenScript =
/opt/splunk/etc/system/default/indexes.conf                  compressRawdata = true
/opt/splunk/etc/system/default/indexes.conf                  defaultDatabase = main
/opt/splunk/etc/system/default/indexes.conf                  enableDataIntegrityControl = false
/opt/splunk/etc/system/default/indexes.conf                  enableOnlineBucketRepair = true

Re: Why am I getting error "Received event for unconfigured/disabled/deleted index="wineventlog"" when the index does exist?

s2_splunk — Wed, 10 Feb 2016 01:13:05 GMT

Hmmm, that is weird. When you run a search on the indexer using index=wineventlog, do you see data? Your screenshot suggests there should be events in it.
The only other thing I can think of is some weird non-printable control character in your inputs.conf.

Re: Why am I getting error "Received event for unconfigured/disabled/deleted index="wineventlog"" when the index does exist?

Epicism1 — Wed, 10 Feb 2016 04:32:19 GMT

Yes, security and application event logs are streaming in no problem. I'll try running dos2unix on the inputs.conf file...

Re: Why am I getting error "Received event for unconfigured/disabled/deleted index="wineventlog"" when the index does exist?

s2_splunk — Wed, 10 Feb 2016 05:43:42 GMT

I think that is a great idea... Please report back.

Re: Why am I getting error "Received event for unconfigured/disabled/deleted index="wineventlog"" when the index does exist?

bandit — Thu, 11 Feb 2016 03:13:21 GMT

If you haven't already done so, I would try restarting your indexers to ensure they are initializing the indexes.conf config updates.

Re: Why am I getting error "Received event for unconfigured/disabled/deleted index="wineventlog"" when the index does exist?

Epicism1 — Sat, 13 Feb 2016 18:20:21 GMT

So I figured out what the issue is. I set the index in inputs.conf which made the hard-coded checksum fail and refuse to install

The universal forwarder splunkd.log has the error:

02-06-2016 05:15:54.061 -0500 INFO  DeployedApplication - Checksum mismatch 0 <> 7566232508823169641 for app=TA-microsoft-sysmon. Will reload from='splunk.projectmayhem.local:8089/services/streams/deployment?name=default:Windows%20Event%20Logs:TA-microsoft-sysmon'
02-06-2016 05:15:54.076 -0500 INFO  DeployedApplication - Downloaded url=splunk.projectmayhem.local:8089/services/streams/deployment?name=default:Windows%20Event%20Logs:TA-microsoft-sysmon to file='C:\Program Files\SplunkUniversalForwarder\var\run\Windows Event Logs\TA-microsoft-sysmon-1454471855.bundle' sizeKB=30
02-06-2016 05:15:54.076 -0500 WARN  DeployedApplication - app=TA-microsoft-sysmon, installed_via="search head cluster deployer, UI, CLI, or REST API", checksum=0b39270c03e818fb6bcadcf51781171cc69e07ce
02-06-2016 05:15:54.076 -0500 WARN  DeployedApplication - app=TA-microsoft-sysmon was already installed via search head cluster deployer, UI, CLI, or REST API; it may not be overridden via deployment server; remove existing app=TA-microsoft-sysmon via search head cluster deployer, UI, CLI, or REST API if you wish to install it via deployment server
02-06-2016 05:15:54.076 -0500 ERROR DeployedServerclass - name=Windows Event Logs Failed to install app=TA-microsoft-sysmon

To fix it I removed the checksum in the app.conf file.

Thanks for your help.

Re: Why am I getting error "Received event for unconfigured/disabled/deleted index="wineventlog"" when the index does exist?

s2_splunk — Mon, 15 Feb 2016 04:33:12 GMT

Why that would cause the message you saw on the indexer I am not sure, but I am glad you figured it out!

Re: Why am I getting error "Received event for unconfigured/disabled/deleted index="wineventlog"" when the index does exist?

Epicism1 — Mon, 15 Feb 2016 14:22:12 GMT

Yeah, that part is weird because it seems to me like it shouldn't be attempting to send any logs to the indexer. Weird.