_audit index remains disabled

[Dark_Ichigo]

Im always getting this error related to the internal _audit index in Splunk:

**received event for unconfigured/disabled index='_audit' with source='source::audittrail' host='host::myhost100' sourcetype='sourcetype::audittrail' (1 missing total)**

Iv tried to enable it but it remains disabled, any ideas?

[Dark_Ichigo · Accepted solution]

I solved the problem by shutting down Splunkd, then deleting the _audit index manually from the CLI, after a Restart, the _audit Index was enabled again.

BTW... mmather67 you do have a point.

[sdwilkerson]

Dark_Ichigo,
If you mean you removed the actual _audit index directory from $SPLUNK_DB, then there is a good chance that there was a duplicate bucket ID that was causing a conflict. An auto-disabled index is often the result of a duplicate bucket ID. There is no natural reason for a duplicate, unless of course you moved/migrated the index from another instance or did something else strange. See this recent post if this was the case: http://splunk-base.splunk.com/answers/34811/how-can-i-find-all-duplicate-bucket-ids-that-are-causing...

[mmather67]

Look for the question "Why is my index disabled?" The answer is there.

PS I wish this site showed what year messages were written.

PPS I wish this site would get you to log in before starting to write an answer. As it is, if you are not already logged in, you write an answer and then lose it.