Error after migration to 4.1.2: Received event for unconfigured/disabled index ...

[Voltaire]

I have received a few errors from my Light Forwarders on my main Splunk indexer.

"received event for unconfigured/disabled index='$splunk_db/qdb/db' with source='source::WMI:RAS Total' host='host::qdbdbt1 ' sourcetype='sourcetype::WMI:RAS Total'"

I also upgraded the lightforwarder to 4.1.2 in hopes of correcting the problem.

Any assistance is greatly appreciated.

Thanks V

[the_wolverine]

This error is new as of version 4.1.2. The error means that you have data coming in for which no index has been configured or enabled. Previously, Splunk did not provide a warning message (in UI) for situations where events are dropped due to non-existent or disabled index.

You should check your LWF configuration for any inputs that might be sending to this index.

Does such an index exist at your indexer? If yes, is the index enabled?