Getting Data In

"Received event for unconfigured/disabled/deleted

rakeshksingh
New Member

Hi All,

"Received event for unconfigured/disabled/deleted "
Facing the above message from number of host with different index names.

As logs are getting from unknown UF to indexer, how to stop these messages without creating indexes ?

Thanks
Rakesh

0 Karma

DalJeanis
Legend

You have two different issues here.

1) An unknown UF is sending information, which your indexers are attempting to index.

2) Your indexers are determining that that data should be in an index that does not exist.

Each of these is a configuration issue.

In order for your indexer to be determining that the events should be placed in a nonexistent index, there generally must be a configuration ON THAT INDEXER that sends them there. Find that configuration and fix it.

If there is no configuration on the indexer that sends data to that index, then you have a heavy forwarder half-cooking the data and sending to the indexers. If there are heavy forwarders in your overall system configuration, that is the place to look for the issue.


Finally, if that UF is completely rogue and the data is not useful, then you can just route all data from that UF to the null queue.

Just create a stanza for that UF/host as per this doc:

https://docs.splunk.com/Documentation/Splunk/latest/Forwarding/Routeandfilterdatad#Filter_event_data...

harsmarvania57
Ultra Champion

Hi,

If you want to ingest those data and if you do not want to create new indexes then you can use below settings in indexes.conf on Indexer to ingest data in predefined existing index if index does not exist in which forwarder wants to ingest data, only drawback is every forwarders which tries to ingest data in unconfigured/disabled/deleted index will end up in same index and if you want to provide different forwarder data access to different users then it will not possible on Search Head with index level access because all such type of forwarders will send data into same index.

lastChanceIndex = <index name>
* Gives ability to define a last chance index for events destined for
  non-existent indexes.
* If an event arrives whose index destination key points to an index that is
  not configured (such as when using index=<index name> in the input stanza or
  by a setting in a transform), it will route that event to the index specified
  by this setting.  The index destination key of that event will be overwritten
  with the specified index name before routing.
* <index name> must name an existing enabled index.  Splunk will not start if
  this is not the case.
* If this setting is not defined or is empty, it will drop such events.
* If set to "default", then the default index specified by the
  "defaultDatabase" will be used as a last chance index.
* Defaults to empty.
0 Karma

p_gurav
Champion

Did you try disabling input and restart splunk service on forwarders?

0 Karma

rakeshksingh
New Member

Thanks Gurav for response.

User used to forward from UF which is installed at their system its unknown host for me.

0 Karma
Get Updates on the Splunk Community!

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...