Getting Data In

Why am I getting "Received event for unconfigured/disabled/deleted index='wineventlog'" after installing a Universal forwarder on a Windows Domain Controller?

asmizaidi
Engager

I've installed a universal forwarder on a Windows Domain Controller and configured on the Splunk server end I enabled receiving, but I got the following error once in messages

Received event for unconfigured/disabled/deleted index='wineventlog' with source='source::WinEventLog:Application' host='host::cc-dc5' sourcetype='sourcetype::WinEventLog:Application' (1 missing total)

I can't even find the host on the Splunk server when searching. Please help. I'm new to this.

Thank you,

1 Solution

MuS
SplunkTrust
SplunkTrust

Hi asmizaidi,

create an index called wineventlog on your indexer, because the universal forwarder sends Windows events by default into this index and since you're missing this index you're getting the message. See the docs for details on how to create an index http://docs.splunk.com/Documentation/Splunk/6.2.4/Indexer/Setupmultipleindexes#Create_and_edit_index...

cheers, MuS

View solution in original post

PaulBendall
New Member

Where you following the documentation for "Splunk App for Windows Infrastructure" v1.1.3? In the documentation it states to

Copy the indexes.conf file from the installation package to the configuration directory on the indexer

But the section in the indexes.conf doesn't match the output.conf later in the documentation which relates to the Windows Add-On

Indexes.conf:

[**winevents**]
homePath = $SPLUNK_DB/winevents/db
coldPath = $SPLUNK_DB/winevents/colddb
thawedPath = $SPLUNK_DB/winevents/thaweddb
maxDataSize = 10000
maxHotBuckets = 10

inputs.conf - from Splunk Add-On for Windows (v4.7.5)

[WinEventLog://Application]
disabled = 1
start_from = oldest
current_only = 0
checkpointInterval = 5
index = **wineventlog**
renderXml=false

I changed the indexes.conf file so that all reference to winevents was wineventlog, copied the update file to .\Splunk\etc\system\local

Paul

0 Karma

sarthur
New Member

Hi,

I have the exact same issue as the OP.

I have followed the steps and it removed the message about the index missing, great!

Now, when looking at my data summary the WIndows host still does not appear... I have restarted the Splunkforwarder service and also restarted my Linux splunk enterprise server.

Any suggestions?

0 Karma

MuS
SplunkTrust
SplunkTrust

Hi asmizaidi,

create an index called wineventlog on your indexer, because the universal forwarder sends Windows events by default into this index and since you're missing this index you're getting the message. See the docs for details on how to create an index http://docs.splunk.com/Documentation/Splunk/6.2.4/Indexer/Setupmultipleindexes#Create_and_edit_index...

cheers, MuS

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...