https://community.splunk.com/t5/Splunk-Search/Received-event-for-unconfigured-disabled-delted/m-p/341003#M161293 <P>I am a splunk novice.</P> <P><A href="Https://answers.splunk.com/answers/522405/why-is-there-no-data-in-my-summary-index.html">Https://answers.splunk.com/answers/522405/why-is-there-no-data-in-my-summary-index.html</A></P> <P>URL of the file or not resolved.</P> <P>Description: I created a Splunk cluster and created a lot of alert strategies on my search server. Some alerts open the summary index, and the summary index name is "alerts", I confirm that the alerts are the existing . And I'm sure a lot of alert have been triggered. But I'm running "index = alerts" on the search server. Return empty And I got this information on the search server's WEBUI: "Received event for unconfigured / disabled / delted ...." as shown below:</P> <P>Question: Why is my summary index no data written? Is there a problem with my configuration?</P> <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/2812iB7DA7625BEAE4758/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> Fri, 21 Apr 2017 07:40:33 GMT xsstest 2017-04-21T07:40:33Z https://community.splunk.com/t5/Splunk-Search/Received-event-for-unconfigured-disabled-delted/m-p/341003#M161293 <P>I am a splunk novice.</P> <P><A href="Https://answers.splunk.com/answers/522405/why-is-there-no-data-in-my-summary-index.html">Https://answers.splunk.com/answers/522405/why-is-there-no-data-in-my-summary-index.html</A></P> <P>URL of the file or not resolved.</P> <P>Description: I created a Splunk cluster and created a lot of alert strategies on my search server. Some alerts open the summary index, and the summary index name is "alerts", I confirm that the alerts are the existing . And I'm sure a lot of alert have been triggered. But I'm running "index = alerts" on the search server. Return empty And I got this information on the search server's WEBUI: "Received event for unconfigured / disabled / delted ...." as shown below:</P> <P>Question: Why is my summary index no data written? Is there a problem with my configuration?</P> <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/2812iB7DA7625BEAE4758/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> Fri, 21 Apr 2017 07:40:33 GMT https://community.splunk.com/t5/Splunk-Search/Received-event-for-unconfigured-disabled-delted/m-p/341003#M161293 xsstest 2017-04-21T07:40:33Z https://community.splunk.com/t5/Splunk-Search/Received-event-for-unconfigured-disabled-delted/m-p/341004#M161294 <P>Have you enabled data forwarding on the search head to send the indexed data to the indexers? You can enable event forwarding on the serch head going to settings &gt; forwarding and receiving &gt; configure forwarding &gt; add your two indexers. This way the data that you asked to index on the search head will be forwarder to the indexers and will get indexed.</P> Fri, 21 Apr 2017 13:49:16 GMT https://community.splunk.com/t5/Splunk-Search/Received-event-for-unconfigured-disabled-delted/m-p/341004#M161294 gfreitas 2017-04-21T13:49:16Z https://community.splunk.com/t5/Splunk-Search/Received-event-for-unconfigured-disabled-delted/m-p/341005#M161295 <P>This is a cluster</P> Mon, 24 Apr 2017 05:40:48 GMT https://community.splunk.com/t5/Splunk-Search/Received-event-for-unconfigured-disabled-delted/m-p/341005#M161295 xsstest 2017-04-24T05:40:48Z https://community.splunk.com/t5/Splunk-Search/Received-event-for-unconfigured-disabled-delted/m-p/341006#M161296 <P>Can you run the below query and verify if the index is created on your indexers?</P> <PRE><CODE>| eventcount summarize=false index=alerts </CODE></PRE> <P>Verify if all your indexers are listed here.<BR /> Try restarting the indexers also once.</P> Mon, 24 Apr 2017 06:30:16 GMT https://community.splunk.com/t5/Splunk-Search/Received-event-for-unconfigured-disabled-delted/m-p/341006#M161296 dineshraj9 2017-04-24T06:30:16Z https://community.splunk.com/t5/Splunk-Search/Received-event-for-unconfigured-disabled-delted/m-p/341007#M161297 <P>result is 0 . What should I do next?</P> Mon, 24 Apr 2017 06:48:32 GMT https://community.splunk.com/t5/Splunk-Search/Received-event-for-unconfigured-disabled-delted/m-p/341007#M161297 xsstest 2017-04-24T06:48:32Z