Newly created data input and index error

jbmitchell — Thu, 17 Jun 2021 00:26:04 GMT

I created a data input for a local file and a new index, the same way that I had done previously for a data input that works and is searchable on the search head. However, this time I am getting the following error:

Received event for unconfigured/disabled/deleted index=cshosts with source="source::/local/splunkdata/cshosts.json" host="host::csplunk31lxv.corp.int" sourcetype="sourcetype::_json". So far received events from 4 missing index(es).

I checked and insured that the index exists and is enabled in the indexer, as well as in the the indexes.conf entry:

[cshosts]
coldPath = $SPLUNK_DB/cshosts/colddb
enableDataIntegrityControl = 0
enableTsidxReduction = 0
homePath = $SPLUNK_DB/cshosts/db
maxTotalDataSizeMB = 512000
thawedPath = $SPLUNK_DB/cshosts/thaweddb
disabled = 0

I have hit a wall and am not sure how to troubleshoot this. Do new indexes take some time before they can begin forwarding the data to the search head? What else could be wrong here?

Thanks

Re: Newly created data input and index error

venkatasri — Thu, 17 Jun 2021 01:28:14 GMT

Hi @jbmitchell

Can you explain how you splunk has been set-up. You shall place monitors on UF/HF most of the cases. how is your outputs.conf looks like in UF/HF?

Re: Newly created data input and index error

isoutamo — Thu, 17 Jun 2021 06:44:34 GMT

Did you add this index with GUI or CLI or edit indexes.conf file? If the last one then you must also reload or restart splunkd to get it as known index.
r. Ismo

topic Re: Newly created data input and index error in Getting Data In

Newly created data input and index error

Re: Newly created data input and index error

Re: Newly created data input and index error