Splunk_TA_nix 5.0.2 Eventtype does not exist or is disabled

[aelliott]

I am getting the following when using the following search:
index=juniperfirewall tag=* |search tag=ids

The tag=* was put there as it was a way to get the search running per:
http://blogs.splunk.com/2011/10/07/cannot-search-based-on-an-extracted-field/

I could easily fix this by removing the eventtypes from where they are failing or adding eventtypes to the config file, however, this is an OOB app and we should not have to customize it to make it work.
In fact I have no idea why I am getting as the tags that seem to be unsearchable are "attack" and "ids"

{'debug': ['[myIndexer] search context: user="admin", app="search", bs-pathname="D:\\Program Files\\Splunk\\var\\run\\searchpeers\\MySearchHead-9999999999"', 'base lispy: [ AND index::juniperfirewall ]', 'search context: user="admin", app="search", bs-pathname="D:\\Program Files\\Splunk\\etc"'], 'warn': ["Eventtype 'gconfd_Linux_syslog' does not exist or is disabled.", "Eventtype 'gdm_Linux_general_syslog' does not exist or is disabled.", "Eventtype 'hpoid' does not exist or is disabled.", "Eventtype 'nix_agpart' does not exist or is disabled.", "Eventtype 'nix_configuration_change' does not exist or is disabled.", "Eventtype 'nix_kernel' does not exist or is disabled.", "Eventtype 'unix_runlevel_change' does not exist or is disabled."]}

[aelliott · Accepted solution]

This ended up being an issue with searching by sourcetype, this was the resolution: http://answers.splunk.com/answers/11856/search-by-sourcetype-returns-no-results