Deployment Architecture

_audit index remains disabled

Dark_Ichigo
Builder

Im always getting this error related to the internal _audit index in Splunk:

**received event for unconfigured/disabled index='_audit' with source='source::audittrail' host='host::myhost100' sourcetype='sourcetype::audittrail' (1 missing total)**

Iv tried to enable it but it remains disabled, any ideas?

0 Karma
1 Solution

Dark_Ichigo
Builder

I solved the problem by shutting down Splunkd, then deleting the _audit index manually from the CLI, after a Restart, the _audit Index was enabled again.

BTW... mmather67 you do have a point.

View solution in original post

Dark_Ichigo
Builder

I solved the problem by shutting down Splunkd, then deleting the _audit index manually from the CLI, after a Restart, the _audit Index was enabled again.

BTW... mmather67 you do have a point.

sdwilkerson
Contributor

Dark_Ichigo,
If you mean you removed the actual _audit index directory from $SPLUNK_DB, then there is a good chance that there was a duplicate bucket ID that was causing a conflict. An auto-disabled index is often the result of a duplicate bucket ID. There is no natural reason for a duplicate, unless of course you moved/migrated the index from another instance or did something else strange. See this recent post if this was the case: http://splunk-base.splunk.com/answers/34811/how-can-i-find-all-duplicate-bucket-ids-that-are-causing...

0 Karma

mmather67
Path Finder

Look for the question "Why is my index disabled?" The answer is there.

PS I wish this site showed what year messages were written.

PPS I wish this site would get you to log in before starting to write an answer. As it is, if you are not already logged in, you write an answer and then lose it.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...