Knowledge Management

Splunk_TA_nix 5.0.2 Eventtype does not exist or is disabled

aelliott
Motivator

I am getting the following when using the following search:
index=juniperfirewall tag=* |search tag=ids

The tag=* was put there as it was a way to get the search running per:
http://blogs.splunk.com/2011/10/07/cannot-search-based-on-an-extracted-field/

I could easily fix this by removing the eventtypes from where they are failing or adding eventtypes to the config file, however, this is an OOB app and we should not have to customize it to make it work.
In fact I have no idea why I am getting as the tags that seem to be unsearchable are "attack" and "ids"

{'debug': ['[myIndexer] search context: user="admin", app="search", bs-pathname="D:\\Program Files\\Splunk\\var\\run\\searchpeers\\MySearchHead-9999999999"', 'base lispy: [ AND index::juniperfirewall ]', 'search context: user="admin", app="search", bs-pathname="D:\\Program Files\\Splunk\\etc"'], 'warn': ["Eventtype 'gconfd_Linux_syslog' does not exist or is disabled.", "Eventtype 'gdm_Linux_general_syslog' does not exist or is disabled.", "Eventtype 'hpoid' does not exist or is disabled.", "Eventtype 'nix_agpart' does not exist or is disabled.", "Eventtype 'nix_configuration_change' does not exist or is disabled.", "Eventtype 'nix_kernel' does not exist or is disabled.", "Eventtype 'unix_runlevel_change' does not exist or is disabled."]}
Tags (2)
1 Solution

aelliott
Motivator

This ended up being an issue with searching by sourcetype, this was the resolution: http://answers.splunk.com/answers/11856/search-by-sourcetype-returns-no-results

View solution in original post

aelliott
Motivator

This ended up being an issue with searching by sourcetype, this was the resolution: http://answers.splunk.com/answers/11856/search-by-sourcetype-returns-no-results

Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...