Installation

Received event for unconfigured/disabled/deleted index=...

christianubeda
Path Finder

Hi team!

I have this error:

alt text

But the Indexter is here. What appends?

alt text

Tags (1)
0 Karma

DavidHourani
Super Champion

Hi @christianubeda,

This errors means that the server receiving the logs does not have that index. It could be a historical message if you've just created the index but if that's not the case then you might have created the index on your search head whereas data is coming in to your indexers (where the index was supposed to be).

To fix this, go on your CM and make sure you deploy the new index configuration to the indexers as shown here in the docs: https://docs.splunk.com/Documentation/Splunk/7.2.6/Indexer/Configurethepeerindexes

Let me know if that helps,

Cheers,
David

0 Karma

jbmitchell
Loves-to-Learn Lots

Hello, currently experience this error on the search head with a newly created index (created on the indexer). Does it take time for the indexer to show up on the search head?

0 Karma

koshyk
Super Champion

please check
1. if you get the errors from a single indexer (in a multi cluster system). if that's case, just check on that single indexer
2. Did permissions change on Unix filesystem?
3. How is the data collected? via UF directly to indexer?
4. Check your indexes.conf on the individual indexer to see everything is good. Do a restart of indexer too

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...