SCCM App for Splunk: Why is a search peer showing "received event for unconfigured/disabled/deleted index='sccm'..."

[barunbiswas]

I am receiving the this message after installing the SCCM App for Splunk:

Search peer host2 has the following message: received event for unconfigured/disabled/deleted index='sccm' with source='source::dbmon-tail://sccm/sccm_agent_discoveries_dbinput' host='host::sccm' sourcetype='sourcetype::sccm:discovery'

The inputs.conf under dbx has been appended with below stanzas.

....
host = sccm
index = sccm
...
...

Splunk is running on host1, indexer is running on host2, and sccm is running on host3. I can see the sccm index from GUI.

Could you advise me on this please?

[maciep]

It sounds like you need the index to be on host2. when you say you see it in the gui, do you mean you see it on host2 in the gui? If you run the following from the cli on host2 (your indexer), what do you get?

splunk btool indexes list sccm --debug | grep -v system/default

[barunbiswas]

Thanks for the reply.
Execution of the above command on host2 gives below output:

/opt/splunk/etc/system/local/indexes.conf [sccm]
/opt/splunk/etc/system/local/indexes.conf coldPath = $SPLUNK_DB/sccm/colddb
/opt/splunk/etc/system/local/indexes.conf homePath = $SPLUNK_DB/sccm/db
/opt/splunk/etc/system/local/indexes.conf thawedPath = $SPLUNK_DB/sccm/thaweddb
/opt/splunk/etc/system/local/indexes.conf [sccm_status]
/opt/splunk/etc/system/local/indexes.conf coldPath = $SPLUNK_DB/sccm_status/colddb
/opt/splunk/etc/system/local/indexes.conf homePath = $SPLUNK_DB/sccm_status/db
/opt/splunk/etc/system/local/indexes.conf thawedPath = $SPLUNK_DB/sccm_status/thaweddb

Please advise what should I do.

[maciep]

Sorry, I don't think I get alerted/emails on these comments so I tend to miss them (I'll check my settings).

Anyway, that looks good to me. Did you restart splunk on the indexer since installing the SCCM app?

[barunbiswas]

Np. Many thanks for the reply.

What I did is:
i) I reloaded indexex on the indexer server using command: ./splunk reload index
ii) restarted Splunk from GUI (Settings-> Server Control)

As I am new to Splunk, could you please advise me what should I do next.

[maciep]

So you're still getting that message?

I'm not sure, honestly. Typically that message means that the index doesn't exist on your indexer. Maybe there is something wrong with index configuration though?