Getting Data In

Ask Help on Indexes

imzakaria
Engager

Hi Spelunker's!.

I'm receiving this message from Splunk 

"Received event for unconfigured/disabled/deleted index=threathunting with source="source::[T1015] Accessibility Features" host="host::hdc-sec01-siem001" sourcetype="sourcetype::stash". So far received events from 1 missing index(es)"

Kindly advice. 
Thank you.

Labels (1)
0 Karma

gcusello
Legend

Hi @imzakaria,

the message means that you configured in your inpus the index threathunting that isn't present in your indexers or is disabled.

Check if the index is enabled and if the name is correct; then check the input.

Ciao.

Giuseppe

imzakaria
Engager

Thank you @gcusello  for the input. We check on my end. 

0 Karma