Archive

Last Chance Index setup issues

lavster
New Member

hello, we are trying to configure a lastchanceindex to capture events being sent to a non-existing index, however it doesnt seem to be working. I've added to the indexes.conf "lastChanceIndex = test_collect_std" but we still get the error message

Search peer indexer-6 has the following message: Received event for unconfigured/disabled/deleted index=fake_index with source="source::D:\tmp\ExampleLog.log" host="host::MACHINE" sourcetype="sourcetype::fake_sourcetype". So far received events from 1 missing index(es).

So the re-route doesnt seem to be doing what it should, there is very little documentation on this. Has anyone successfully got this to work?

For info we are running 7.3.0

0 Karma

adonio
SplunkTrust
SplunkTrust

can you share your indexes.conf?
this configuration should be under the [default] stanza ... so should look something like this:

indexes.conf:

[default]
lastChanceIndex = main

[index1]
homePath   = $SPLUNK_DB/index1/db
coldPath   = $SPLUNK_DB/index1/colddb
thawedPath = $SPLUNK_DB/index1/thaweddb
maxDataSize = 10000
maxHotBuckets = 10

[index2]
homePath   = $SPLUNK_DB/index2/db
coldPath   = $SPLUNK_DB/index2/colddb
thawedPath = $SPLUNK_DB/index2/thaweddb
maxDataSize = 10000
maxHotBuckets = 10

.....
0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!