Error after migration to 4.1.2: Received event for unconfigured/disabled index ...


I have received a few errors from my Light Forwarders on my main Splunk indexer.

"received event for unconfigured/disabled index='$splunk_db/qdb/db' with source='source::WMI:RAS Total' host='host::qdbdbt1 ' sourcetype='sourcetype::WMI:RAS Total'"

I also upgraded the lightforwarder to 4.1.2 in hopes of correcting the problem.

Any assistance is greatly appreciated.

Thanks V

Tags (1)
0 Karma


This error is new as of version 4.1.2. The error means that you have data coming in for which no index has been configured or enabled. Previously, Splunk did not provide a warning message (in UI) for situations where events are dropped due to non-existent or disabled index.

You should check your LWF configuration for any inputs that might be sending to this index.

Does such an index exist at your indexer? If yes, is the index enabled?

Get Updates on the Splunk Community!

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...