I created a data input for a local file and a new index, the same way that I had done previously for a data input that works and is searchable on the search head. However, this time I am getting the following error:
Received event for unconfigured/disabled/deleted index=cshosts with source="source::/local/splunkdata/cshosts.json" host="host::csplunk31lxv.corp.int" sourcetype="sourcetype::_json". So far received events from 4 missing index(es).
I checked and insured that the index exists and is enabled in the indexer, as well as in the the indexes.conf entry:
[cshosts]
coldPath = $SPLUNK_DB/cshosts/colddb
enableDataIntegrityControl = 0
enableTsidxReduction = 0
homePath = $SPLUNK_DB/cshosts/db
maxTotalDataSizeMB = 512000
thawedPath = $SPLUNK_DB/cshosts/thaweddb
disabled = 0
I have hit a wall and am not sure how to troubleshoot this. Do new indexes take some time before they can begin forwarding the data to the search head? What else could be wrong here?
Thanks
Hi @jbmitchell
Can you explain how you splunk has been set-up. You shall place monitors on UF/HF most of the cases. how is your outputs.conf looks like in UF/HF?