All Apps and Add-ons

Splunk Add-on for Microsoft Windows: Why am I getting error "received event for unconfigured/disabled/deleted index='sec_events'"?

weicai88
Path Finder

I have a distributed deployment and use a Universal Forwarder on Windows to get the event logs and performance information into indexers. After deploying the Splunk_TA_windows to the Windows client, the event log data comes into the indexers and get indexed to wineventlog just fine. However, I still get errors as below:

Search peer idx2 has the following message: received event for unconfigured/disabled/deleted index='sec_events' with source='source::Perfmon:Available Memory' host='host::Prod-TS1' sourcetype='sourcetype::Perfmon:Available Memory' (1 missing total) 8/7/2015, 3:40:29 PM

I checked both my indexers and forwarders, but could not find where the index "sec_events" came from. If you have any suggestions please let me know.

Thanks!

0 Karma
1 Solution

weicai88
Path Finder

I noticed that even after I stopped the Forwarder, the errors still popped up so it didn't appear to be from the data source. I then restarted one of the three indexers and that cleared up all the errors.

View solution in original post

0 Karma

weicai88
Path Finder

I noticed that even after I stopped the Forwarder, the errors still popped up so it didn't appear to be from the data source. I then restarted one of the three indexers and that cleared up all the errors.

0 Karma

jeffland
SplunkTrust
SplunkTrust

How are you checking your forwarders? Have you tried btool?

0 Karma

weicai88
Path Finder

Jeff,

Yes, btool was what I used to search where the index came from on both the indexers and forwarder. "sec_events" is not present in the output.

Thanks,
Wei

0 Karma

jeffland
SplunkTrust
SplunkTrust

You need to look at the inputs. This command

./splunk cmd btool inputs list --debug | grep sec_events

should show you which is the input in question and its location.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...