Newly created data input and index error

[jbmitchell]

I created a data input for a local file and a new index, the same way that I had done previously for a data input that works and is searchable on the search head. However, this time I am getting the following error:

Received event for unconfigured/disabled/deleted index=cshosts with source="source::/local/splunkdata/cshosts.json" host="host::csplunk31lxv.corp.int" sourcetype="sourcetype::_json". So far received events from 4 missing index(es).

I checked and insured that the index exists and is enabled in the indexer, as well as in the the indexes.conf entry:

[cshosts]
coldPath = $SPLUNK_DB/cshosts/colddb
enableDataIntegrityControl = 0
enableTsidxReduction = 0
homePath = $SPLUNK_DB/cshosts/db
maxTotalDataSizeMB = 512000
thawedPath = $SPLUNK_DB/cshosts/thaweddb
disabled = 0

I have hit a wall and am not sure how to troubleshoot this.  Do new indexes take some time before they can begin forwarding the data to the search head? What else could be wrong here?

Thanks

[isoutamo]

Did you add this index with GUI or CLI or edit indexes.conf file? If the last one then you must also reload or restart splunkd to get it as known index.
r. Ismo

[venkatasri]

Hi @jbmitchell 

Can you explain how you splunk has been set-up. You shall place monitors on UF/HF most of the cases. how is your outputs.conf looks like in UF/HF?