topic WARN : Eventtype 'xxxxxxxx' does not exist or is disabled. Errors coming from indexers in Splunk Search https://community.splunk.com/t5/Splunk-Search/WARN-Eventtype-xxxxxxxx-does-not-exist-or-is-disabled-Errors/m-p/378262#M170535 <P>hi all,</P> <P>I have had a number of scheduled searches that failed, all returning the same errors.</P> <P>WARN : Eventtype 'xxxxxxxx' does not exist or is disabled.<BR /> WARN : [INDEXER 1] Eventtype 'xxxxxxxx' does not exist or is disabled.<BR /> WARN : [INDEXER 2] Eventtype 'xxxxxxxx' does not exist or is disabled.<BR /> WARN : [INDEXER 3] Eventtype 'xxxxxxxx' does not exist or is disabled.<BR /> WARN : [INDEXER 4] Eventtype 'xxxxxxxx' does not exist or is disabled.</P> <P>Could someone explain why the indexers were returning the errors when all eventtypes are located on the search heads ?</P> <P>cheers<BR /> Paul</P> Wed, 03 Jul 2019 12:11:16 GMT pbrinkman 2019-07-03T12:11:16Z WARN : Eventtype 'xxxxxxxx' does not exist or is disabled. Errors coming from indexers https://community.splunk.com/t5/Splunk-Search/WARN-Eventtype-xxxxxxxx-does-not-exist-or-is-disabled-Errors/m-p/378262#M170535 <P>hi all,</P> <P>I have had a number of scheduled searches that failed, all returning the same errors.</P> <P>WARN : Eventtype 'xxxxxxxx' does not exist or is disabled.<BR /> WARN : [INDEXER 1] Eventtype 'xxxxxxxx' does not exist or is disabled.<BR /> WARN : [INDEXER 2] Eventtype 'xxxxxxxx' does not exist or is disabled.<BR /> WARN : [INDEXER 3] Eventtype 'xxxxxxxx' does not exist or is disabled.<BR /> WARN : [INDEXER 4] Eventtype 'xxxxxxxx' does not exist or is disabled.</P> <P>Could someone explain why the indexers were returning the errors when all eventtypes are located on the search heads ?</P> <P>cheers<BR /> Paul</P> Wed, 03 Jul 2019 12:11:16 GMT https://community.splunk.com/t5/Splunk-Search/WARN-Eventtype-xxxxxxxx-does-not-exist-or-is-disabled-Errors/m-p/378262#M170535 pbrinkman 2019-07-03T12:11:16Z Re: WARN : Eventtype 'xxxxxxxx' does not exist or is disabled. Errors coming from indexers https://community.splunk.com/t5/Splunk-Search/WARN-Eventtype-xxxxxxxx-does-not-exist-or-is-disabled-Errors/m-p/378263#M170536 <P>Search heads push a bundle of knowledge objects to the indexers, to enable the indexers to perform searches.</P> <P>These errors are typically caused by a tag (in tags.conf) that refers to an eventtype that is not defined / disabled / in another app and not shared / not readable by current user.</P> Wed, 03 Jul 2019 13:14:52 GMT https://community.splunk.com/t5/Splunk-Search/WARN-Eventtype-xxxxxxxx-does-not-exist-or-is-disabled-Errors/m-p/378263#M170536 FrankVl 2019-07-03T13:14:52Z