Error after migration to 4.1.2: Received event for unconfigured/disabled index ...


I have received a few errors from my Light Forwarders on my main Splunk indexer.

"received event for unconfigured/disabled index='$splunk_db/qdb/db' with source='source::WMI:RAS Total' host='host::qdbdbt1 ' sourcetype='sourcetype::WMI:RAS Total'"

I also upgraded the lightforwarder to 4.1.2 in hopes of correcting the problem.

Any assistance is greatly appreciated.

Thanks V

Tags (1)
0 Karma


This error is new as of version 4.1.2. The error means that you have data coming in for which no index has been configured or enabled. Previously, Splunk did not provide a warning message (in UI) for situations where events are dropped due to non-existent or disabled index.

You should check your LWF configuration for any inputs that might be sending to this index.

Does such an index exist at your indexer? If yes, is the index enabled?

Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...