I was having a problem with an index created by an app, so I manually created one as a test. I went to delete the index with the splunk remove index command. It says "Unable to remove disabled indexes.." I go to enable the index so I can delete it and it says "deleted, cannot enable..". I am caught in a loop. I cannot find the index in indexes.conf anywhere. Looks like the indexes.conf files have not been modified in some time. I am not sure how to remove this index and I really need the index name for the app to work.
1. there are `default index` in splunk that you can not remove or disabled.
2. there are also some `index-related `applications you installed in splunk. these indexes can not be disabled or deleted
I think you must have a problem in connection with the second case mentioned above.
I determined that there it was an indexes.conf file under the appname\default directory that still had the index. I did not find it earlier because when i did search for indexes.conf under the root, my account did not have permission to that folder. I removed the index there and it is no longer showing up.