Getting Data In

Newly created data input and index error

jbmitchell
Loves-to-Learn Lots

I created a data input for a local file and a new index, the same way that I had done previously for a data input that works and is searchable on the search head. However, this time I am getting the following error:

 

Received event for unconfigured/disabled/deleted index=cshosts with source="source::/local/splunkdata/cshosts.json" host="host::csplunk31lxv.corp.int" sourcetype="sourcetype::_json". So far received events from 4 missing index(es).

 

I checked and insured that the index exists and is enabled in the indexer, as well as in the the indexes.conf entry:

 

[cshosts]
coldPath = $SPLUNK_DB/cshosts/colddb
enableDataIntegrityControl = 0
enableTsidxReduction = 0
homePath = $SPLUNK_DB/cshosts/db
maxTotalDataSizeMB = 512000
thawedPath = $SPLUNK_DB/cshosts/thaweddb
disabled = 0

 

I have hit a wall and am not sure how to troubleshoot this.  Do new indexes take some time before they can begin forwarding the data to the search head? What else could be wrong here?

 

Thanks

Labels (3)
0 Karma

isoutamo
SplunkTrust
SplunkTrust
Did you add this index with GUI or CLI or edit indexes.conf file? If the last one then you must also reload or restart splunkd to get it as known index.
r. Ismo
0 Karma

venkatasri
Influencer

Hi @jbmitchell 

Can you explain how you splunk has been set-up. You shall place monitors on UF/HF most of the cases. how is your outputs.conf looks like in UF/HF? 

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.