Knowledge Management

Splunk_TA_nix 5.0.2 Eventtype does not exist or is disabled

aelliott
Motivator

I am getting the following when using the following search:
index=juniperfirewall tag=* |search tag=ids

The tag=* was put there as it was a way to get the search running per:
http://blogs.splunk.com/2011/10/07/cannot-search-based-on-an-extracted-field/

I could easily fix this by removing the eventtypes from where they are failing or adding eventtypes to the config file, however, this is an OOB app and we should not have to customize it to make it work.
In fact I have no idea why I am getting as the tags that seem to be unsearchable are "attack" and "ids"

{'debug': ['[myIndexer] search context: user="admin", app="search", bs-pathname="D:\\Program Files\\Splunk\\var\\run\\searchpeers\\MySearchHead-9999999999"', 'base lispy: [ AND index::juniperfirewall ]', 'search context: user="admin", app="search", bs-pathname="D:\\Program Files\\Splunk\\etc"'], 'warn': ["Eventtype 'gconfd_Linux_syslog' does not exist or is disabled.", "Eventtype 'gdm_Linux_general_syslog' does not exist or is disabled.", "Eventtype 'hpoid' does not exist or is disabled.", "Eventtype 'nix_agpart' does not exist or is disabled.", "Eventtype 'nix_configuration_change' does not exist or is disabled.", "Eventtype 'nix_kernel' does not exist or is disabled.", "Eventtype 'unix_runlevel_change' does not exist or is disabled."]}
Tags (2)
1 Solution

aelliott
Motivator

This ended up being an issue with searching by sourcetype, this was the resolution: http://answers.splunk.com/answers/11856/search-by-sourcetype-returns-no-results

View solution in original post

aelliott
Motivator

This ended up being an issue with searching by sourcetype, this was the resolution: http://answers.splunk.com/answers/11856/search-by-sourcetype-returns-no-results

Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...