Ask Help on Indexes

[imzakaria]

Hi Spelunker's!.

I'm receiving this message from Splunk 

"Received event for unconfigured/disabled/deleted index=threathunting with source="source::[T1015] Accessibility Features" host="host::hdc-sec01-siem001" sourcetype="sourcetype::stash". So far received events from 1 missing index(es)"

Kindly advice. 
Thank you.

[gcusello]

Hi @imzakaria,

the message means that you configured in your inpus the index threathunting that isn't present in your indexers or is disabled.

Check if the index is enabled and if the name is correct; then check the input.

Ciao.

Giuseppe

[imzakaria]

Thank you @gcusello  for the input. We check on my end.