Lastchance index troubleshooting

[kiran_panchavat]

@ayomotukoya As @richgalloway  said, lastchanceindex is a Pre-defined in Splunk Cloud. Accepts events sent to a non-existing index. So please create index first before onboarding data to Splunk Cloud. 

lastchanceindex:-

[Input Y]
index = $%^&*

[richgalloway]

There should be a bulletin message saying an event was put in lastchanceindex because the intended index doesn't exist.  Look for and correct the intended index name on the syslog server.

[ayomotukoya]

thankyou, where would that bulletin be found? We get a number of events into our lastchance index.

[richgalloway]

Bulletin messages are found in the "Messages" dropdown.

If the messages are no longer available, you can use the host, source and sourcetype values in lastchanceindex to find where the data is coming from and make the necessary corrections.