received event for unconfigured/disabled/deleted index='msad' with source='source::ActiveDirectory' host='host::WP000265' sourcetype='sourcetype::ActiveDirectory'

[pavanae]

I was getting the message as follows. What should i have to do to get those logs?

[jkat54 · Accepted solution]

Create an index on your peers (indexers) called msad, or enable the existing msad index, or change the inputs.conf to send the data to another index.