Splunk Add-on for Microsoft Windows: Why am I getting error "received event for unconfigured/disabled/deleted index='sec_events'"?

[weicai88]

I have a distributed deployment and use a Universal Forwarder on Windows to get the event logs and performance information into indexers. After deploying the Splunk_TA_windows to the Windows client, the event log data comes into the indexers and get indexed to wineventlog just fine. However, I still get errors as below:

Search peer idx2 has the following message: received event for unconfigured/disabled/deleted index='sec_events' with source='source::Perfmon:Available Memory' host='host::Prod-TS1' sourcetype='sourcetype::Perfmon:Available Memory' (1 missing total) 8/7/2015, 3:40:29 PM

I checked both my indexers and forwarders, but could not find where the index "sec_events" came from. If you have any suggestions please let me know.

Thanks!

[weicai88 · Accepted solution]

I noticed that even after I stopped the Forwarder, the errors still popped up so it didn't appear to be from the data source. I then restarted one of the three indexers and that cleared up all the errors.

[jeffland]

How are you checking your forwarders? Have you tried btool?

[weicai88]

Jeff,

Yes, btool was what I used to search where the index came from on both the indexers and forwarder. "sec_events" is not present in the output.

Thanks,
Wei

[jeffland]

You need to look at the inputs. This command

./splunk cmd btool inputs list --debug | grep sec_events

should show you which is the input in question and its location.