topic Re: How can we clean messages about unconfigured/disabled/deleted indexes? in Splunk Search

How can we clean messages about unconfigured/disabled/deleted indexes?

ddrillic — Mon, 18 Sep 2017 16:27:37 GMT

We have some messages saying -

Search peer <host> has the following message: Received event for unconfigured/disabled/deleted index=<index_name> with source="<source_name>" host="<host_name>" sourcetype="<sourcetype_name>". So far received events from 6 missing index(es).

Since this index - <index_name> doesn't exist, I wonder if I should delete these events at parse time based on the index name. Is it possible?

Re: How can we clean messages about unconfigured/disabled/deleted indexes?

richgalloway — Mon, 18 Sep 2017 16:52:43 GMT

The best way to clean up those messages is fix the cause of them. Create the missing index (or enable it if it's disabled). By ignoring this message you risk losing data if you don't have a default index configured.

Re: How can we clean messages about unconfigured/disabled/deleted indexes?

ddrillic — Mon, 18 Sep 2017 17:52:38 GMT

Thank you @richgalloway. In this case, the events are not needed. Is there a way to eliminate them at parsing time?

Re: How can we clean messages about unconfigured/disabled/deleted indexes?

DalJeanis — Mon, 18 Sep 2017 18:09:07 GMT

If you want to eliminate those events, then route them to the nullqueue instead of the non-existent index.

https://answers.splunk.com/answers/59370/filtering-events-using-nullqueue.html

You COULD put a stanza for that index, but it would be better to take the stanza that is currently routing event to that index and route them instead to the null queue.

Re: How can we clean messages about unconfigured/disabled/deleted indexes?

ddrillic — Mon, 18 Sep 2017 18:14:21 GMT

Thank you @DalJeanis - gorgeous as usual.

Re: How can we clean messages about unconfigured/disabled/deleted indexes?

richgalloway — Mon, 18 Sep 2017 18:17:50 GMT

If the events are coming from the same input, deleting that input.conf stanza will stop them from coming in.
You can use btool to find the inputs.conf file to edit. splunk btool --debug inputs list | grep <index_name>.

Re: How can we clean messages about unconfigured/disabled/deleted indexes?

ddrillic — Mon, 18 Sep 2017 18:22:33 GMT

Right, right, to some forwarders we don't have access at all and their inputs.conf is not always being administered by the central deployment server...

Re: How can we clean messages about unconfigured/disabled/deleted indexes?

DalJeanis — Tue, 19 Sep 2017 00:23:04 GMT

@ddrillic - I'm honored.