topic Re: unconfigured/disabled/deleted index=windows_server_winupdate in Getting Data In

unconfigured/disabled/deleted index=windows_server_winupdate

IWilsonR — Wed, 30 Sep 2020 02:50:39 GMT

Hi All,

I have configured UF agent on windows machine. I dont see it's reporting in forwarder management and also no incoming logs.

but i got the below message in splunk. Kindly let me know what is the configuration flaw.

unconfigured/disabled/deleted index=windows_server_winupdate with source="source::WinEventLog:Microsoft-Windows-WindowsUpdateClient/Operational" host="host::hostname" sourcetype="sourcetype::WinEventLog:Microsoft-Windows-WindowsUpdateClient/Operational". So far received events from 6 missing index(es).

note: I did a telnet from the UF machine to my deployment server through default port 8089. It's working.

Splunk version: 7.1.6

Re: unconfigured/disabled/deleted index=windows_server_winupdate

richgalloway — Wed, 30 Sep 2020 02:50:58 GMT

The UF is trying to write data to an index, windows_server_winupdate, that doesn't exist. Either create the index on your indexer(s) or change the UF's inputs.conf to use the correct index name.

Re: unconfigured/disabled/deleted index=windows_server_winupdate

IWilsonR — Wed, 30 Sep 2020 02:59:28 GMT

Thanks for your reply. I have created an index for this host and it started indexing in the correct index name i have created. But still i am getting the message, can we disable this from sending this logs to splunk.

I need the security, system and application which is now iam getting in splunk.

Sample Message:

unconfigured/disabled/deleted index=windows_server_powershell with source="source::WinEventLog:Microsoft-Windows-PowerShell/Operational" host="host::hostname" sourcetype="sourcetype::WinEventLog:Microsoft-Windows-PowerShell/Operational". So far received events from 2 missing index(es).

Sample Message2:

unconfigured/disabled/deleted index=windows_server_sysmon with source="source::WinEventLog:Microsoft-Windows-Sysmon/Operational" host="host::hostname" sourcetype="sourcetype::WinEventLog:Microsoft-Windows-Sysmon/Operational". So far received events from 1 missing index(es).

Re: unconfigured/disabled/deleted index=windows_server_winupdate

richgalloway — Fri, 15 Nov 2019 12:49:39 GMT

There are two ways to prevent those messages: 1) create the missing index; 2) disable the input(s) sending to the missing index.
Make sure to create the indexes on the indexer, not just on the search head.