Deployment Architecture

_audit index remains disabled

Dark_Ichigo
Builder

Im always getting this error related to the internal _audit index in Splunk:

**received event for unconfigured/disabled index='_audit' with source='source::audittrail' host='host::myhost100' sourcetype='sourcetype::audittrail' (1 missing total)**

Iv tried to enable it but it remains disabled, any ideas?

0 Karma
1 Solution

Dark_Ichigo
Builder

I solved the problem by shutting down Splunkd, then deleting the _audit index manually from the CLI, after a Restart, the _audit Index was enabled again.

BTW... mmather67 you do have a point.

View solution in original post

Dark_Ichigo
Builder

I solved the problem by shutting down Splunkd, then deleting the _audit index manually from the CLI, after a Restart, the _audit Index was enabled again.

BTW... mmather67 you do have a point.

sdwilkerson
Contributor

Dark_Ichigo,
If you mean you removed the actual _audit index directory from $SPLUNK_DB, then there is a good chance that there was a duplicate bucket ID that was causing a conflict. An auto-disabled index is often the result of a duplicate bucket ID. There is no natural reason for a duplicate, unless of course you moved/migrated the index from another instance or did something else strange. See this recent post if this was the case: http://splunk-base.splunk.com/answers/34811/how-can-i-find-all-duplicate-bucket-ids-that-are-causing...

0 Karma

mmather67
Path Finder

Look for the question "Why is my index disabled?" The answer is there.

PS I wish this site showed what year messages were written.

PPS I wish this site would get you to log in before starting to write an answer. As it is, if you are not already logged in, you write an answer and then lose it.

Get Updates on the Splunk Community!

New Case Study Shows the Value of Partnering with Splunk Academic Alliance

The University of Nevada, Las Vegas (UNLV) is another premier research institution helping to shape the next ...

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...