Getting Data In

Newly created data input and index error

jbmitchell
Loves-to-Learn Lots

I created a data input for a local file and a new index, the same way that I had done previously for a data input that works and is searchable on the search head. However, this time I am getting the following error:

 

Received event for unconfigured/disabled/deleted index=cshosts with source="source::/local/splunkdata/cshosts.json" host="host::csplunk31lxv.corp.int" sourcetype="sourcetype::_json". So far received events from 4 missing index(es).

 

I checked and insured that the index exists and is enabled in the indexer, as well as in the the indexes.conf entry:

 

[cshosts]
coldPath = $SPLUNK_DB/cshosts/colddb
enableDataIntegrityControl = 0
enableTsidxReduction = 0
homePath = $SPLUNK_DB/cshosts/db
maxTotalDataSizeMB = 512000
thawedPath = $SPLUNK_DB/cshosts/thaweddb
disabled = 0

 

I have hit a wall and am not sure how to troubleshoot this.  Do new indexes take some time before they can begin forwarding the data to the search head? What else could be wrong here?

 

Thanks

Labels (3)
0 Karma

isoutamo
SplunkTrust
SplunkTrust
Did you add this index with GUI or CLI or edit indexes.conf file? If the last one then you must also reload or restart splunkd to get it as known index.
r. Ismo
0 Karma

venkatasri
SplunkTrust
SplunkTrust

Hi @jbmitchell 

Can you explain how you splunk has been set-up. You shall place monitors on UF/HF most of the cases. how is your outputs.conf looks like in UF/HF? 

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...